From 8cd0b7f61959573e9b48741ba0921d9179920f13 Mon Sep 17 00:00:00 2001
From: James Ives <iam@jamesiv.es>
Date: Tue, 9 Dec 2025 14:53:25 -0500
Subject: [PATCH] fix: issue with failing checkout

---
 __tests__/git.test.ts  | 7 ++++---
 __tests__/main.test.ts | 4 ++--
 src/git.ts             | 8 +++++---
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/__tests__/git.test.ts b/__tests__/git.test.ts
index b028f421a..3b6af7dc7 100644
--- a/__tests__/git.test.ts
+++ b/__tests__/git.test.ts
@@ -54,7 +54,7 @@ describe('git', () => {
       })
 
       await init(action)
-      expect(execute).toHaveBeenCalledTimes(9)
+      expect(execute).toHaveBeenCalledTimes(10)
     })
 
     it('should catch when a function throws an error', async () => {
@@ -101,7 +101,7 @@ describe('git', () => {
       })
 
       await init(action)
-      expect(execute).toHaveBeenCalledTimes(9)
+      expect(execute).toHaveBeenCalledTimes(10)
     })
 
     it('should not unset git config if a user is using ssh', async () => {
@@ -144,7 +144,7 @@ describe('git', () => {
       })
 
       await init(action)
-      expect(execute).toHaveBeenCalledTimes(9)
+      expect(execute).toHaveBeenCalledTimes(10)
     })
 
     it('should remove includeIf git config sections when present', async () => {
@@ -168,6 +168,7 @@ describe('git', () => {
         })
         .mockImplementationOnce(() => ({stdout: '', stderr: ''})) // remove-section includeIf --local
         .mockImplementationOnce(() => ({stdout: '', stderr: ''})) // git config --global --get-regexp includeIf
+        .mockImplementationOnce(() => ({stdout: '', stderr: ''})) // git config --system --get-regexp includeIf
         .mockImplementationOnce(() => ({stdout: '', stderr: ''})) // git remote rm
         .mockImplementationOnce(() => ({stdout: '', stderr: ''})) // git remote add
 
diff --git a/__tests__/main.test.ts b/__tests__/main.test.ts
index b42bca49d..c56da4f3a 100644
--- a/__tests__/main.test.ts
+++ b/__tests__/main.test.ts
@@ -53,7 +53,7 @@ describe('main', () => {
       debug: true
     })
     await run(action)
-    expect(execute).toHaveBeenCalledTimes(21)
+    expect(execute).toHaveBeenCalledTimes(22)
     expect(rmRF).toHaveBeenCalledTimes(1)
     expect(exportVariable).toHaveBeenCalledTimes(1)
   })
@@ -73,7 +73,7 @@ describe('main', () => {
       isTest: TestFlag.HAS_CHANGED_FILES
     })
     await run(action)
-    expect(execute).toHaveBeenCalledTimes(24)
+    expect(execute).toHaveBeenCalledTimes(25)
     expect(rmRF).toHaveBeenCalledTimes(1)
     expect(exportVariable).toHaveBeenCalledTimes(1)
   })
diff --git a/src/git.ts b/src/git.ts
index c6942b307..7932eaa6f 100644
--- a/src/git.ts
+++ b/src/git.ts
@@ -78,12 +78,14 @@ export async function init(action: ActionInterface): Promise<void | Error> {
 
     // Remove includeIf directives that point to credential files (actions/checkout@v6+)
     try {
-      if ((process.env.CI && !action.sshKey) || action.isTest) {
+      // Always try to remove includeIf credentials when not using SSH key
+      // This is necessary because actions/checkout@v6+ uses includeIf to inject credentials
+      if (!action.sshKey || action.isTest) {
         /* actions/checkout@v6+ uses includeIf directives to inject credentials.
            We need to remove these to ensure the provided token/SSH key is used instead.
-           Check both local and global scopes as containers may configure differently.
+           Check local, global, and system scopes as containers may configure differently.
         */
-        for (const scope of ['--local', '--global']) {
+        for (const scope of ['--local', '--global', '--system']) {
           try {
             const includeIfResult = await execute(
               `git config ${scope} --get-regexp 'includeIf\\..*\\.path'`,