From fc08c3315c317c8ec11463ff378cc42a1588bed2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Burzy=C5=84ski?= <mateuszburzynski@gmail.com>
Date: Mon, 6 Jul 2026 23:11:05 +0200
Subject: [PATCH] Ensure `github-token` wins for `git-cli` pushes

---
 src/github.ts | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/github.ts b/src/github.ts
index 54553463..5fbc5879 100644
--- a/src/github.ts
+++ b/src/github.ts
@@ -86,10 +86,19 @@ export class GitHub {
         `Invalid GIT_CONFIG_COUNT value: ${process.env.GIT_CONFIG_COUNT}`,
       );
     }
+    const extraHeaderKey = `http.${serverUrl}/.extraheader`;
+    const authHeader = `AUTHORIZATION: basic ${basic}`;
+
     return {
-      GIT_CONFIG_COUNT: String(gitConfigCount + 1),
-      [`GIT_CONFIG_KEY_${gitConfigCount}`]: `http.${serverUrl}/.extraheader`,
-      [`GIT_CONFIG_VALUE_${gitConfigCount}`]: `AUTHORIZATION: basic ${basic}`,
+      GIT_CONFIG_COUNT: String(gitConfigCount + 2),
+      // Reset inherited extraheaders first. In v1, `github-token` was written
+      // to ~/.netrc, so checkout's persisted extraheader could win for pushes.
+      // The ~/.netrc token was effectively only a fallback for git auth.
+      // Here `github-token` intentionally wins.
+      [`GIT_CONFIG_KEY_${gitConfigCount}`]: extraHeaderKey,
+      [`GIT_CONFIG_VALUE_${gitConfigCount}`]: "",
+      [`GIT_CONFIG_KEY_${gitConfigCount + 1}`]: extraHeaderKey,
+      [`GIT_CONFIG_VALUE_${gitConfigCount + 1}`]: authHeader,
     };
   }