Fix repo memory retry head refresh authentication

[Copilot]

Concurrent push_repo_memory writers could exhaust retries on private/internal repos because retry head refresh used unauthenticated origin. When git ls-remote origin failed, reconciliation never rebased onto the latest remote head.

• Authenticated retry refresh
  • Refresh retry base via the existing authenticated retry URL instead of origin.
  • Run the command silently to avoid logging credential-bearing URLs.

await execGetExecOutput(
  "git",
  ["ls-remote", repoUrlWithToken, `refs/heads/${branchName}`],
  { cwd: workspaceDir, silent: true }
);

• Regression coverage
  • Added a focused test confirming retry refresh uses the authenticated repository URL and not origin.

• Fixes push_repo_memory retry never refreshes its base: git ls-remote origin runs without credentials #63416

---

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 23.9 AIC · ⌖ 8.62 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

Copilot review overview

🟢 Approval recommended

The targeted fix resolves the reported authentication failure and includes appropriate regression coverage.

Review effort: Balanced
Findings: None

What changed in this PR

Fixes authenticated retry-head refreshes for concurrent repo-memory pushes on private/internal repositories.

Changes:

• Uses the authenticated retry URL for git ls-remote.
• Suppresses credential-bearing command output.
• Adds focused regression coverage.

File	Description
actions/​setup/​js/​push_repo_memory.cjs	Authenticates retry head refreshes.
actions/​setup/​js/​push_repo_memory.test.cjs	Verifies authenticated, silent refresh behavior.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[gh-aw-bot]

@copilot There is still forward progress needed on this PR.

• Please refresh the branch if needed and then run the pr-finisher skill to wrap up review feedback, checks, and final polish.
• A branch refresh was requested from sous-chef for this run: https://github.com/github/gh-aw/actions/runs/36181242958

Generated by 👨🍳 PR Sous Chef · pi · gpt54
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 23.9 AIC · ⌖ 8.62 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed: PR does not have the 'implementation' label and has <=100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Generated by Ponytail Reviewer for #63497

[github-actions]

🔎 PR Code Quality Reviewer is reviewing code quality for this pull request...

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

Comment Memory

reviewed_at: 2026-09-25T19:54:24.867+00:00
review_event: REQUEST_CHANGES
top_themes:
  - token leak risk from logging authenticated ls-remote failures
files_reviewed:
  - actions/setup/js/push_repo_memory.cjs
  - actions/setup/js/push_repo_memory.test.cjs
comment_count: 1

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 38.3 AIC · ⌖ 7.33 AIC · ⊞ 20.3K · ◷
_{Comment /review to run again}

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs — small, well-scoped fix with a targeted regression test. No actionable issues found.

📋 Analysis

Root cause fix: The retry-refresh ls-remote was previously run against unauthenticated origin, which fails silently (caught and swallowed) on private/internal repos, causing retries to never rebase onto the latest remote head and eventually exhaust MAX_RETRIES. Switching to repoUrlWithToken (the same authenticated URL already used for fetch/reconcileRepoMemoryRetry) fixes the root cause rather than just a symptom.

Credential hygiene: Adding silent: true is correct and necessary — @actions/exec echoes the full command line (including the embedded-token URL) to the log unless silent is set, so this avoids a credential leak that the URL swap would otherwise introduce.

Regression test: The new test in push_repo_memory.test.cjs asserts the exact ls-remote call args (retryRepoUrl, silent: true) and confirms the retry succeeds after a transient failure — this pins the fix and would catch a regression back to origin.

Minor observations (non-blocking):

• The catch block for lsRemoteError at line 190 only logs getErrorMessage(lsRemoteError); this is fine since @actions/exec's default thrown error doesn't embed the command string, so no token leakage risk there either.
• No test exercises the ls-remote failure path (falling back to existing currentBaseRef), but that path is unchanged by this PR, so it's out of scope here.

Nothing else stood out as risky given the narrow, one-line production change.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 40.4 AIC · ⌖ 13.4 AIC · ⊞ 10.1K
_{Comment /matt to run again}

[Copilot]

@copilot There is still forward progress needed on this PR.

• Please refresh the branch if needed and then run the pr-finisher skill to wrap up review feedback, checks, and final polish....

The branch already includes the current main tip, so no refresh was required. I completed the PR finisher checks locally: make fmt, make lint, make test-unit, make test, and make recompile all passed with a clean tree.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.89.22