Github Actions - git command ls-remote fails for private repo when on runner (works locally)

[aormsby]

I’m using this command to check and see if a remote private repo exists and the user has access to it:

git ls-remote https://<user name>:<token>@github.com/<repo owner>/<repo name>.git

Also checking for a branch on the remote repo:

git ls-remote <same url> <branch name>

These should be able to access the private repo using the access token passed into the action, and I should get an actual read on the remote repo and its refs. However, I receive a git error:

remote: Repository not found. fatal: repository 'https://github.com/aoAppDev/upstream-sync-test-remote.git/' not found

Notably, this output doesn’t include the classic *** to hide the token in the output URL because, well… it isn’t in this error URL at all.

It’s not an issue with the token or URL because the action successfully clones the private repo immediately after these commands fail. (Also, it works as expected on my local machine.)

So why would this command fail on the runner?
Is there some config I’m missing?
Something blocking the use of ls-remote with a secret token??

I’m at a loss here.

[aormsby]

I figured out the problem! I was using the GH checkout action as a first step, and the GITHUB_TOKEN credentials were automatically persisting through the entire workflow. So anytime I tried to run a command requiring the auth token for the second remote repo, it was using the persisted credentials. I set persist-credentials to false, and my commands work as expected.

Some odd things about this, though –

• If I have the auth token in the remote URL, I don’t see why the action would even try to use the persisted auth token.
• Why did the clone work while the other commands didn’t? Super strange.

Anyway, I hope this helps someone down the line. Happy coding!

[dodomood]

Spent almost 8h today on this shit. Thank you for existing! 🥇

[pedroscaff]

I also spent a few hours on this, unbelievable that this is the default behavior 😢. Thank you very much!

[robindowling]

I spent hours on this as well, thank you for sharing and allowing me to finally move on from this 😊

[dan-developer]

Thank you for existing! 🥇

[nikitaeverywhere]

Thanks for sharing this! Saved a few hours of debugging for sure.

[Nokel81]

Thank you sooo much!!! I have the same set up it seems where I call git ls-remote (with the auth in the URL) which would fail for private repos. But if I tried to clone a specific tag it would work.

[bloodearnest]

Thanks for this. We had accidentally included the .git/ dir in our docker image, and then git ls-remote was failing in production due to the cached credentials.