Cannot checkout remote public repo that doesn't require auth

[allwalte]

I'm trying to build an action that checks out both a repo from our GHE (the repo the workflow is in), as well as a public repo on github.com. For the latter, I'm using the "github-server-url" argument, which seems to be taking effect because in the initialization phase for this second checkout I see remote add origin https://github.com// (redactions mine, they're correct and visible in the pipeline :-) ). However, the checkout fails at the Retrieving the default branch name step, with "Bad credentials". I'm not specifying a PAT, it's my understanding that this repo is publicly accessible so I shouldn't need one. I can certainly view everything from a private browser, not logged in. And also, in the body of the job, if I do a git clone of that repo, it works. So I'm not certain what's missing to make the checkout step work?

I brought this up here and it was suggested that perhaps the problem was that an auth header was being explicitly set by the checkout action, but our auth would not work on that remote repo. So I tried to look into how to not send that auth and found this comment in another issue - "If you don't want actions/checkout to set the extra header, you can set persist-credentials to false."

However, I tried that, and the header is still there. In that same issue, someone else mentions the same thing at the bottom - #181 (comment)

In the ADR it says that even though this header is added, "Additional public remotes also just work." That's not what I'm experiencing though, unless there's something I'm missing.