From 45e4f0ea18322f7ff8f4ec4d6924075531561b30 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 20 Feb 2026 04:10:28 +0000
Subject: [PATCH 1/6] Initial plan


From 8c424cb968bd428811a34f002396b413a7deb513 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 20 Feb 2026 04:14:48 +0000
Subject: [PATCH 2/6] initial plan

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/smoke-test-tools.lock.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index 42eb07c092..b3686f4e6d 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -671,7 +671,7 @@ jobs:
         timeout-minutes: 5
         run: |
           set -o pipefail
-          sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.githubusercontent.com,*.jsr.io,*.pythonhosted.org,adoptium.net,anaconda.org,api.adoptium.net,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.foojay.io,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.npms.io,api.nuget.org,api.snapcraft.io,archive.apache.org,archive.ubuntu.com,azure.archive.ubuntu.com,azuresearch-usnc.nuget.org,azuresearch-ussc.nuget.org,binstar.org,bootstrap.pypa.io,builds.dotnet.microsoft.com,bun.sh,cdn.azul.com,cdn.jsdelivr.net,central.sonatype.com,ci.dot.net,codeload.github.com,conda.anaconda.org,conda.binstar.org,crates.io,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,dc.services.visualstudio.com,deb.nodesource.com,deno.land,dist.nuget.org,dl.google.com,dlcdn.apache.org,dot.net,dotnet.microsoft.com,dotnetcli.blob.core.windows.net,download.eclipse.org,download.java.net,download.oracle.com,esm.sh,files.pythonhosted.org,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,github.githubassets.com,go.dev,golang.org,googleapis.deno.dev,googlechromelabs.github.io,goproxy.io,gradle.org,host.docker.internal,index.crates.io,jcenter.bintray.com,jdk.java.net,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,lfs.github.com,maven.apache.org,maven.google.com,maven.oracle.com,maven.pkg.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,nuget.org,nuget.pkg.github.com,nugetregistryv2prod.blob.core.windows.net,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,oneocsp.microsoft.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,pkg.go.dev,pkgs.dev.azure.com,plugins-artifacts.gradle.org,plugins.gradle.org,ppa.launchpad.net,proxy.golang.org,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.anaconda.com,repo.continuum.io,repo.gradle.org,repo.grails.org,repo.maven.apache.org,repo.spring.io,repo.yarnpkg.com,repo1.maven.org,s.symcb.com,s.symcd.com,security.ubuntu.com,services.gradle.org,skimdb.npmjs.com,static.crates.io,storage.googleapis.com,sum.golang.org,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.java.com,www.microsoft.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.20.2 --skip-pull --enable-api-proxy \
+          sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.githubusercontent.com,*.jsr.io,*.pythonhosted.org,adoptium.net,anaconda.org,api.adoptium.net,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.foojay.io,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.npms.io,api.nuget.org,api.snapcraft.io,archive.apache.org,archive.ubuntu.com,azure.archive.ubuntu.com,azuresearch-usnc.nuget.org,azuresearch-ussc.nuget.org,binstar.org,bootstrap.pypa.io,builds.dotnet.microsoft.com,bun.sh,cdn.azul.com,cdn.jsdelivr.net,central.sonatype.com,ci.dot.net,codeload.github.com,conda.anaconda.org,conda.binstar.org,crates.io,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,dc.services.visualstudio.com,deb.nodesource.com,deno.land,dist.nuget.org,dl.google.com,dlcdn.apache.org,dot.net,dotnet.microsoft.com,dotnetcli.blob.core.windows.net,download.eclipse.org,download.java.net,download.oracle.com,downloads.gradle-dn.com,esm.sh,files.pythonhosted.org,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,github.githubassets.com,go.dev,golang.org,googleapis.deno.dev,googlechromelabs.github.io,goproxy.io,gradle.org,host.docker.internal,index.crates.io,jcenter.bintray.com,jdk.java.net,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,lfs.github.com,maven.apache.org,maven.google.com,maven.oracle.com,maven.pkg.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,nuget.org,nuget.pkg.github.com,nugetregistryv2prod.blob.core.windows.net,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,oneocsp.microsoft.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,pkg.go.dev,pkgs.dev.azure.com,plugins-artifacts.gradle.org,plugins.gradle.org,ppa.launchpad.net,proxy.golang.org,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.anaconda.com,repo.continuum.io,repo.gradle.org,repo.grails.org,repo.maven.apache.org,repo.spring.io,repo.yarnpkg.com,repo1.maven.org,s.symcb.com,s.symcd.com,security.ubuntu.com,services.gradle.org,skimdb.npmjs.com,static.crates.io,storage.googleapis.com,sum.golang.org,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.java.com,www.microsoft.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.20.2 --skip-pull --enable-api-proxy \
             -- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
           COPILOT_AGENT_RUNNER_TYPE: STANDALONE

From 3625e938d5078a323d37242effe017f869d6f090 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 20 Feb 2026 04:18:12 +0000
Subject: [PATCH 3/6] Update clean_git_credentials.sh to recursively find and
 clean all git checkouts in workspace and /tmp/

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/sh/clean_git_credentials.sh | 116 ++++++++++++----------
 1 file changed, 63 insertions(+), 53 deletions(-)

diff --git a/actions/setup/sh/clean_git_credentials.sh b/actions/setup/sh/clean_git_credentials.sh
index 2627ac1f96..2c0df08869 100755
--- a/actions/setup/sh/clean_git_credentials.sh
+++ b/actions/setup/sh/clean_git_credentials.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 #
-# clean_git_credentials.sh - Remove git credentials from .git/config
+# clean_git_credentials.sh - Remove git credentials from all git checkouts
 #
 # This script removes any git credentials that may have been left on disk
-# accidentally by an injected step. It specifically targets the credentials
-# in $GITHUB_WORKSPACE/.git/config to prevent credential leakage.
+# accidentally by an injected step. It recursively finds all .git/config
+# files in $GITHUB_WORKSPACE and /tmp/ and cleans credentials from each.
 #
 # This is a security measure to ensure that git credentials configured by
 # custom steps or other workflow steps are removed before the agentic engine
@@ -16,65 +16,75 @@
 
 set -euo pipefail
 
-# Get the workspace directory (defaults to current GITHUB_WORKSPACE)
-WORKSPACE="${GITHUB_WORKSPACE:-.}"
-GIT_CONFIG_PATH="${WORKSPACE}/.git/config"
+# clean_git_config removes credentials from a single .git/config file
+clean_git_config() {
+  local GIT_CONFIG_PATH="$1"
 
-echo "Cleaning git credentials from ${GIT_CONFIG_PATH@Q}"
+  echo "Cleaning git credentials from ${GIT_CONFIG_PATH@Q}"
 
-# Check if .git/config exists
-if [ ! -f "${GIT_CONFIG_PATH}" ]; then
-  echo "No .git/config found at ${GIT_CONFIG_PATH@Q}, nothing to clean"
-  exit 0
-fi
+  # Remove credential helper configuration
+  # This removes lines like:
+  #   [credential]
+  #       helper = ...
+  # And any credential URL-specific configs like:
+  #   [credential "https://github.com"]
+  #       helper = ...
+  if git config --file "${GIT_CONFIG_PATH}" --remove-section credential 2>/dev/null; then
+    echo "Removed [credential] section from git config"
+  fi
 
-# Remove credential helper configuration
-# This removes lines like:
-#   [credential]
-#       helper = ...
-# And any credential URL-specific configs like:
-#   [credential "https://github.com"]
-#       helper = ...
-if git config --file "${GIT_CONFIG_PATH}" --remove-section credential 2>/dev/null; then
-  echo "Removed [credential] section from git config"
-fi
+  # Remove credential URL-specific sections using sed
+  # Pattern: match lines from "[credential ..." to the next section header,
+  # deleting the credential header line and all lines until the next "[" section.
+  sed -i '/^\[credential /,/^\[/{ /^\[credential /d; /^\[/!d; }' "${GIT_CONFIG_PATH}" 2>/dev/null || true
 
-# Remove credential URL-specific sections using grep
-# This handles multi-line credential sections with URLs
-sed -i '/^\[credential /,/^\[/{ /^\[credential /d; /^\[/!d; }' "${GIT_CONFIG_PATH}" 2>/dev/null || true
+  # Remove http extraheader (used by GitHub Actions for authentication)
+  # This is used by actions/checkout to authenticate
+  if git config --file "${GIT_CONFIG_PATH}" --unset-all http.extraheader 2>/dev/null; then
+    echo "Removed http.extraheader from git config"
+  fi
 
-# Remove http extraheader (used by GitHub Actions for authentication)
-# This is used by actions/checkout to authenticate
-if git config --file "${GIT_CONFIG_PATH}" --unset-all http.extraheader 2>/dev/null; then
-  echo "Removed http.extraheader from git config"
-fi
+  # Remove any http.<url>.extraheader configurations
+  git config --file "${GIT_CONFIG_PATH}" --get-regexp '^http\..*\.extraheader$' 2>/dev/null | while read -r key _; do
+    git config --file "${GIT_CONFIG_PATH}" --unset-all "$key" || true
+    echo "Removed $key from git config"
+  done || true
 
-# Remove any http.<url>.extraheader configurations
-git config --file "${GIT_CONFIG_PATH}" --get-regexp '^http\..*\.extraheader$' 2>/dev/null | while read -r key _; do
-  git config --file "${GIT_CONFIG_PATH}" --unset-all "$key" || true
-  echo "Removed $key from git config"
-done || true
+  # Remove any credentials from remote URLs (https://username:password@github.com format)
+  # Replace authenticated URLs with unauthenticated ones
+  if git config --file "${GIT_CONFIG_PATH}" --get-regexp '^remote\..*\.url$' 2>/dev/null | grep -q '@'; then
+    echo "Found authenticated remote URLs, cleaning..."
+    git config --file "${GIT_CONFIG_PATH}" --get-regexp '^remote\..*\.url$' 2>/dev/null | while read -r key url; do
+      # Remove credentials from URL: https://user:pass@host -> https://host
+      clean_url=$(echo "$url" | sed -E 's|(https?://)([^@]+@)?(.*)|\1\3|')
+      if [ "$url" != "$clean_url" ]; then
+        git config --file "${GIT_CONFIG_PATH}" "$key" "$clean_url"
+        echo "Cleaned credentials from $key"
+      fi
+    done || true
+  fi
 
-# Remove any credentials from remote URLs (https://username:password@github.com format)
-# Replace authenticated URLs with unauthenticated ones
-if git config --file "${GIT_CONFIG_PATH}" --get-regexp '^remote\..*\.url$' 2>/dev/null | grep -q '@'; then
-  echo "Found authenticated remote URLs, cleaning..."
-  git config --file "${GIT_CONFIG_PATH}" --get-regexp '^remote\..*\.url$' 2>/dev/null | while read -r key url; do
-    # Remove credentials from URL: https://user:pass@host -> https://host
-    clean_url=$(echo "$url" | sed -E 's|(https?://)([^@]+@)?(.*)|\1\3|')
-    if [ "$url" != "$clean_url" ]; then
-      git config --file "${GIT_CONFIG_PATH}" "$key" "$clean_url"
-      echo "Cleaned credentials from $key"
-    fi
-  done || true
-fi
+  echo "✓ Git credentials cleaned from ${GIT_CONFIG_PATH@Q}"
+
+  # Verify the file is still valid git config
+  if ! git config --file "${GIT_CONFIG_PATH}" --list >/dev/null 2>&1; then
+    echo "ERROR: Git config file is corrupted after cleaning: ${GIT_CONFIG_PATH@Q}"
+    exit 1
+  fi
+}
+
+# Get the workspace directory (defaults to current GITHUB_WORKSPACE)
+WORKSPACE="${GITHUB_WORKSPACE:-.}"
 
-echo "✓ Git credentials cleaned successfully"
+# Collect all .git/config files to clean from workspace and /tmp/
+CLEANED=0
+while IFS= read -r git_config; do
+  clean_git_config "${git_config}"
+  CLEANED=$((CLEANED + 1))
+done < <(find "${WORKSPACE}" /tmp -maxdepth 10 -name "config" -path "*/.git/config" 2>/dev/null | sort -u)
 
-# Verify the file is still valid git config
-if ! git config --file "${GIT_CONFIG_PATH}" --list >/dev/null 2>&1; then
-  echo "ERROR: Git config file is corrupted after cleaning"
-  exit 1
+if [ "${CLEANED}" -eq 0 ]; then
+  echo "No .git/config files found, nothing to clean"
 fi
 
 exit 0

From 6f1232ca881df7ab6b090211fe3a0914fb2b9704 Mon Sep 17 00:00:00 2001
From: runner <runner@github.com>
Date: Fri, 20 Feb 2026 04:23:23 +0000
Subject: [PATCH 4/6] Add changeset [skip-ci]

---
 .changeset/patch-clean-git-credentials-recursive.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/patch-clean-git-credentials-recursive.md

diff --git a/.changeset/patch-clean-git-credentials-recursive.md b/.changeset/patch-clean-git-credentials-recursive.md
new file mode 100644
index 0000000000..fa529d4f2a
--- /dev/null
+++ b/.changeset/patch-clean-git-credentials-recursive.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Ensure `clean_git_credentials.sh` recursively discovers every `.git/config` under the workspace and `/tmp/`, deduplicates the list, and reuses a helper when cleaning each file.

From 64ba040f4b470cac3f236e5efd0d0ee0b829c443 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 20 Feb 2026 04:29:29 +0000
Subject: [PATCH 5/6] Add integration test for clean_git_credentials.sh

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .../setup/sh/clean_git_credentials_test.sh    | 153 ++++++++++++++++++
 1 file changed, 153 insertions(+)
 create mode 100644 actions/setup/sh/clean_git_credentials_test.sh

diff --git a/actions/setup/sh/clean_git_credentials_test.sh b/actions/setup/sh/clean_git_credentials_test.sh
new file mode 100644
index 0000000000..a19ace2f54
--- /dev/null
+++ b/actions/setup/sh/clean_git_credentials_test.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# Test script for clean_git_credentials.sh
+# Run: bash clean_git_credentials_test.sh
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CLEAN_SCRIPT="${SCRIPT_DIR}/clean_git_credentials.sh"
+
+# Test counters
+TESTS_PASSED=0
+TESTS_FAILED=0
+
+# Temporary workspace for tests
+TEST_WORKSPACE=$(mktemp -d)
+
+cleanup() {
+  rm -rf "${TEST_WORKSPACE}"
+}
+trap cleanup EXIT
+
+# Helper: create a minimal git repo with a .git/config file
+make_git_config() {
+  local dir="$1"
+  local config="$2"
+  mkdir -p "${dir}/.git"
+  echo "${config}" >"${dir}/.git/config"
+}
+
+# Helper: assert a condition
+assert() {
+  local name="$1"
+  local condition="$2"
+  if eval "${condition}"; then
+    echo "✓ ${name}"
+    TESTS_PASSED=$((TESTS_PASSED + 1))
+  else
+    echo "✗ ${name}"
+    TESTS_FAILED=$((TESTS_FAILED + 1))
+  fi
+}
+
+echo "Testing clean_git_credentials.sh..."
+echo ""
+
+# ── Test 1: No .git/config anywhere (no-op, exit 0) ─────────────────────────
+echo "Test 1: No .git/config files → exit 0 with informational message"
+EMPTY_WS=$(mktemp -d)
+OUTPUT=$(GITHUB_WORKSPACE="${EMPTY_WS}" bash "${CLEAN_SCRIPT}" 2>&1)
+EXIT_CODE=$?
+rmdir "${EMPTY_WS}"
+assert "exits 0 when no .git/config found" "[ ${EXIT_CODE} -eq 0 ]"
+assert "prints informational message" "echo '${OUTPUT}' | grep -q 'No .git/config'"
+echo ""
+
+# ── Test 2: Removes [credential] section ────────────────────────────────────
+echo "Test 2: Removes [credential] section from workspace .git/config"
+REPO="${TEST_WORKSPACE}/repo2"
+make_git_config "${REPO}" "[core]
+	repositoryformatversion = 0
+[credential]
+	helper = store
+[remote \"origin\"]
+	url = https://github.com/org/repo.git"
+GITHUB_WORKSPACE="${REPO}" bash "${CLEAN_SCRIPT}" >/dev/null 2>&1
+assert "credential section removed" "! grep -q '\[credential\]' '${REPO}/.git/config'"
+assert "core section preserved"    "grep -q '\[core\]' '${REPO}/.git/config'"
+assert "remote section preserved"  "grep -q '\[remote' '${REPO}/.git/config'"
+echo ""
+
+# ── Test 3: Removes http.extraheader ────────────────────────────────────────
+echo "Test 3: Removes http.extraheader from git config"
+REPO="${TEST_WORKSPACE}/repo3"
+make_git_config "${REPO}" "[core]
+	repositoryformatversion = 0
+[http]
+	extraheader = Authorization: Basic dXNlcjpwYXNz"
+GITHUB_WORKSPACE="${REPO}" bash "${CLEAN_SCRIPT}" >/dev/null 2>&1
+assert "http.extraheader removed" "! git config --file '${REPO}/.git/config' http.extraheader 2>/dev/null"
+assert "config still valid"       "git config --file '${REPO}/.git/config' --list >/dev/null 2>&1"
+echo ""
+
+# ── Test 4: Strips credentials from remote URL ──────────────────────────────
+echo "Test 4: Strips credentials from authenticated remote URL"
+REPO="${TEST_WORKSPACE}/repo4"
+make_git_config "${REPO}" "[core]
+	repositoryformatversion = 0
+[remote \"origin\"]
+	url = https://x-access-token:ghs_abc123@github.com/org/repo.git
+	fetch = +refs/heads/*:refs/remotes/origin/*"
+GITHUB_WORKSPACE="${REPO}" bash "${CLEAN_SCRIPT}" >/dev/null 2>&1
+CLEANED_URL=$(git config --file "${REPO}/.git/config" remote.origin.url)
+assert "credentials stripped from URL" "[ '${CLEANED_URL}' = 'https://github.com/org/repo.git' ]"
+echo ""
+
+# ── Test 5: Recursively finds repo nested inside workspace ──────────────────
+echo "Test 5: Recursively cleans nested git repo inside workspace"
+OUTER="${TEST_WORKSPACE}/outer5"
+INNER="${OUTER}/vendor/dep"
+make_git_config "${OUTER}" "[core]
+	repositoryformatversion = 0
+[credential]
+	helper = store"
+make_git_config "${INNER}" "[core]
+	repositoryformatversion = 0
+[http]
+	extraheader = Authorization: Basic dXNlcjpwYXNz"
+GITHUB_WORKSPACE="${OUTER}" bash "${CLEAN_SCRIPT}" >/dev/null 2>&1
+assert "outer credential section cleaned" "! grep -q '\[credential\]' '${OUTER}/.git/config'"
+assert "inner extraheader cleaned"         "! git config --file '${INNER}/.git/config' http.extraheader 2>/dev/null"
+echo ""
+
+# ── Test 6: Finds git repo in /tmp ──────────────────────────────────────────
+echo "Test 6: Cleans git repo located in /tmp"
+TMP_REPO=$(mktemp -d)
+make_git_config "${TMP_REPO}" "[core]
+	repositoryformatversion = 0
+[credential]
+	helper = store"
+# Use a workspace that does NOT contain the repo so it is found only via /tmp
+GITHUB_WORKSPACE="${TEST_WORKSPACE}/workspace6"
+mkdir -p "${GITHUB_WORKSPACE}"
+GITHUB_WORKSPACE="${GITHUB_WORKSPACE}" bash "${CLEAN_SCRIPT}" >/dev/null 2>&1
+assert "tmp repo credential section cleaned" "! grep -q '\[credential\]' '${TMP_REPO}/.git/config'"
+rm -rf "${TMP_REPO}"
+echo ""
+
+# ── Test 7: Config file remains valid after all cleanups ────────────────────
+echo "Test 7: Config file is still valid after cleaning"
+REPO="${TEST_WORKSPACE}/repo7"
+make_git_config "${REPO}" "[core]
+	repositoryformatversion = 0
+[credential]
+	helper = /usr/lib/git-credential-gnome-keyring
+[http]
+	extraheader = Authorization: Bearer sometoken
+[remote \"origin\"]
+	url = https://oauth2:tok@github.com/org/repo.git
+	fetch = +refs/heads/*:refs/remotes/origin/*"
+GITHUB_WORKSPACE="${REPO}" bash "${CLEAN_SCRIPT}" >/dev/null 2>&1
+assert "config still valid" "git config --file '${REPO}/.git/config' --list >/dev/null 2>&1"
+assert "core settings intact" "git config --file '${REPO}/.git/config' core.repositoryformatversion >/dev/null 2>&1"
+echo ""
+
+# ── Summary ──────────────────────────────────────────────────────────────────
+echo "Tests passed: ${TESTS_PASSED}"
+echo "Tests failed: ${TESTS_FAILED}"
+
+if [ "${TESTS_FAILED}" -gt 0 ]; then
+  exit 1
+fi
+
+echo "✓ All tests passed!"

From 97f7d639325bb536526bdecb36afd4a3119d117b Mon Sep 17 00:00:00 2001
From: Smoke Test Claude <smoke-test@github.com>
Date: Fri, 20 Feb 2026 04:28:46 +0000
Subject: [PATCH 6/6] test: Add smoke test file for run 22211157844

---
 .smoke-test-22211157844 | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .smoke-test-22211157844

diff --git a/.smoke-test-22211157844 b/.smoke-test-22211157844
new file mode 100644
index 0000000000..4ae4471fb6
--- /dev/null
+++ b/.smoke-test-22211157844
@@ -0,0 +1 @@
+Smoke test run 22211157844