Github plugin having duplicate Authorization header (problem with private repos?)

[mzealey]

Description

Trying to make it generate a commit for an issue:

remote: Duplicate header: "Authorization"
fatal: unable to access 'https://github.com/.../': The requested URL returned error: 400
1069 |             await $`git commit -m "${summary}
1070 | 
Creating comment...
1071 | Co-authored-by: ${actor} <${actor}@users.noreply.github.com>"`
1072 |           }
1073 |         }
1074 |         await $`git push -u origin ${branch}`
                      ^
ShellError: Failed with exit code 128
 exitCode: 128,
   stdout: "",
   stderr: "remote: Duplicate header: \"Authorization\"\nfatal: unable to access 'https://github.com/.../': The requested URL returned error: 400\n",
      at new ShellPromise (75:16)
      at BunShell (191:35)
      at pushToNewBranch (src/cli/cmd/github.ts:1074:15)

It should have all the required permissions:

  name: opencode
  
  on:
    issue_comment:
      types: [created]
    pull_request_review_comment:
      types: [created]
  
  permissions:
    id-token: write
    contents: write
    pull-requests: write
    issues: write
  
  jobs:
    opencode:
      if: |
        contains(github.event.comment.body, ' /oc') ||
        startsWith(github.event.comment.body, '/oc') ||
        contains(github.event.comment.body, ' /opencode') ||
        startsWith(github.event.comment.body, '/opencode')
      runs-on: ubuntu-latest
      steps:
        - name: Checkout repository
          uses: actions/checkout@v6
  
        - name: Run opencode
          uses: anomalyco/opencode/github@latest
          env:
            ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          with:
            model: anthropic/claude-opus-4-5

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

github runners

Terminal

No response

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Remote MCPs with auth header broke in latest update #5328: Remote MCPs with auth header broke in latest update (shows same 'Duplicate header: Authorization' error)
• GitHub Integration is not pushing changes in PRs #1417: GitHub Integration is not pushing changes in PRs
• [Github agent] If the agent commits but doesn't push, the resulting commits are never pushed #3893: [Github agent] If the agent commits but doesn't push, the resulting commits are never pushed

Feel free to ignore if none of these address your specific case.

[mzealey]

I believe this is different from the MCP issue above

[mzealey]

setting TOKEN: "${{ secrets.GITHUB_TOKEN }}" does not fix the issue in 1.1.11

[lucapette]

Just run into this. Not sure if #7562 is supposed to fix this (to be fair I'm unsure it's in opencode-Linux-X64-v1.1.14)

[rekram1-node]

hmmm

[pid1]

This job works as a workaround

name: opencode

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]

jobs:
  opencode:
    if: |
      contains(github.event.comment.body, '/oc') ||
      contains(github.event.comment.body, '/opencode')
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      pull-requests: write
      issues: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Clear checkout auth header
        run: git config --local --unset-all http.https://github.com/.extraheader || true

      - name: Run OpenCode
        uses: anomalyco/opencode/github@latest
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          model: anthropic/claude-opus-4-5
          share: true
          use_github_token: true

[LeonMueller-OneAndOnly]

Cleaner Solution: persist-credentials: false

Rather than clearing the auth header after checkout, a cleaner fix is to prevent actions/checkout@v6 from persisting credentials in the first place:

steps:
  - uses: actions/checkout@v6
    with:
      persist-credentials: false  # Prevents duplicate Authorization header
  - uses: anomalyco/opencode/github@latest

Root Cause

1. actions/checkout@v6 persists the GitHub token to git config via http.extraheader
2. The anomalyco/opencode/github@latest action then adds its own authentication
3. Both Authorization headers get sent to GitHub → 400 error

Suggested Fix for OpenCode

The default workflow templates should be updated to include persist-credentials: false. This affects:

• opencode setup command output in the TUI
• Documentation examples (scheduled review workflows)
• Any template files in the repository (e.g., opencode-review.yml, opencode.yml)

This would prevent users from encountering this issue when following the official setup instructions.

[mzealey]

#7325 (comment) is the correct solution thanks

[lucapette]

I can confirm that #7325 works! thank you @LeonMueller-OneAndOnly to for taking care of it!