Duplicate header: "Authorization"

[petlitskiy]

Faced when using actions/checkout@main:

  /usr/bin/git remote prune origin
  remote: Duplicate header: "Authorization"
  fatal: unable to access 'https://github.com/***/****/': The requested URL returned error: 400
  Error: The process '/usr/bin/git' failed with exit code 128

[ericsciple]

@petlitskiy are you using a self-hosted runner or a hosted runner?

[ericsciple]

@petlitskiy or do you have multiple checkout steps for the same job?

[mgetzflex]

@ericsciple I'm also seeing this error on self-hosted runners without any duplicate checkouts.

We had to use the following environment variables to get things working again:

GIT_AUTHORIZATION_BEARER: ${{ secrets.GITHUB_TOKEN }}
DEFAULT_BRANCH: main

Which according to the docs should not need to be set

[ericsciple]

@mgetzflex do you also have the same issue with actions/checkout@v5 ? Or just actions/checkout@main ? I would assume both would fail, but good to verify since the authorization logic recently changed in main.

Do you have authorization configured in the global or system git config? You can check by queuing a job to the same runner like the following:

jobs:
  test:
    runs-on: your-runner-label
    steps:
      - run: git config --list --global || true
      - run: git config --list --system || true

[totus]

@ericsciple, the issue seems to stem from this change: #2286

I'm also seeing the problem on the GitHub (non-standalone) runners in jobs with multiple and single checkout actions.

[kdeldycke]

I confirm the issue with 6.0.0. Had to revert to 5.0.1 to fix the issue.

[ericsciple]

@totus @kdeldycke can you help me understand how to reproduce the issue? Can you share a small self-contained example?

[ericsciple]

@kdeldycke in your case it looks like the action peter-evans/create-pull-request is adding an auth header, but doesn't know how to clean up the new actions/checkout v6 style auth configuration. Either that action would need to react, or you can set persist-credentials: false to actions/checkout.

[ericsciple]

Related issue:

• Incompatible with actions/checkout@v6 peter-evans/create-pull-request#4228

[eriksw]

@ericsciple What would an appropriate (simple and stable) strategy be for actions like create-pull-request to use, where there is a need to temporarily run some number of git commands using different credentials? The persist-credentials: false workaround has an additional downside of breaking git commands that interact with the remote in other steps where having the default auth present is desired/expected.

[SJLC]

@kdeldycke in your case it looks like the action peter-evans/create-pull-request is adding an auth header, but doesn't know how to clean up the new actions/checkout v6 style auth configuration. Either that action would need to react, or you can set persist-credentials: false to actions/checkout.

@ericsciple can you expand on what "clean up" an action based on v5 would need to do, in order to be compatible with v6?