Auth error trying to copy a repo with Github Actions

Question

I have a bunch of repos that use Azure Pipelines for CI/CD, which I'm now trying to port to Github Actions. This is the first one I'm working on: https://github.com/Azure/AzureAuth/tree/fix-ghaction

I've got it 99% working but I'm getting a weird authentication error on one step. The repo is mirrored to another org (cloudyr), and I use this step to do the mirroring:

  - name: Copy to Cloudyr
    if: runner.os == 'Linux'
    env:
      token: "${{ secrets.ghPat }}"
    run: |
      export CLOUDYR_REPO=$(echo $GITHUB_REPOSITORY | sed "s/Azure/cloudyr/")
      git push --prune https://[email protected]/${CLOUDYR_REPO}.git +refs/remotes/origin/*:refs/heads/* +refs/tags/*:refs/tags/*

This retrieves a PAT from the repo secrets, and does a git push. It was working perfectly well with Azure Pipelines, but now it fails with the following error:

Run export CLOUDYR_REPO=$(echo $GITHUB_REPOSITORY | sed "s/Azure/cloudyr/")
remote: Permission to cloudyr/AzureAuth.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/cloudyr/AzureAuth.git/': The requested URL returned error: 403
Error: Process completed with exit code 128.

Can anyone explain what's causing this, and how to fix it? I have admin access to both the Azure/AzureAuth and cloudyr/AzureAuth repos. I've also checked that the PAT is valid.

Failed log is here: https://github.com/Azure/AzureAuth/runs/1228152900?check_suite_focus=true

bk2204 bk2204 · Accepted Answer · 2020-10-08T22:37:09

GitHub Actions stores a configuration option using one of the http.extraheader options to send the original token for cloning your repository in a custom Authorization header. This is a bad idea because it then conflicts with the Authorization header added by Git when you use another repository, and the token that's issued is only valid for the original repository.

If you want to push to a different repository, then you need to unset that configuration option by doing something like this:

git config -l | grep 'http\..*\.extraheader' | cut -d= -f1 | \
    xargs -L1 git config --unset-all

In addition, you should avoid passing the authorization token in the username field. While GitHub has filtering for this, it's more likely that the username field appears in logs, so it's a best practice to pass it in the password field using a dummy name, like so:

git push --prune https://token:[email protected]/${CLOUDYR_REPO}.git

Auth error trying to copy a repo with Github Actions

1 Answers