Github Actions - git command ls-remote fails for private repo when on runner (works locally)

[aormsby]

I’m using this command to check and see if a remote private repo exists and the user has access to it:

git ls-remote https://<user name>:<token>@github.com/<repo owner>/<repo name>.git

Also checking for a branch on the remote repo:

git ls-remote <same url> <branch name>

These should be able to access the private repo using the access token passed into the action, and I should get an actual read on the remote repo and its refs. However, I receive a git error:

remote: Repository not found. fatal: repository 'https://github.com/aoAppDev/upstream-sync-test-remote.git/' not found

Notably, this output doesn’t include the classic *** to hide the token in the output URL because, well… it isn’t in this error URL at all.

It’s not an issue with the token or URL because the action successfully clones the private repo immediately after these commands fail. (Also, it works as expected on my local machine.)

So why would this command fail on the runner?
Is there some config I’m missing?
Something blocking the use of ls-remote with a secret token??

I’m at a loss here.

[aormsby]

I figured out the problem! I was using the GH checkout action as a first step, and the GITHUB_TOKEN credentials were automatically persisting through the entire workflow. So anytime I tried to run a command requiring the auth token for the second remote repo, it was using the persisted credentials. I set persist-credentials to false, and my commands work as expected.

Some odd things about this, though –

• If I have the auth token in the remote URL, I don’t see why the action would even try to use the persisted auth token.
• Why did the clone work while the other commands didn’t? Super strange.

Anyway, I hope this helps someone down the line. Happy coding!

[jebarrocal]

I spend too many hours with this shit.
Love you. Thank you for share this.

[galnadjar]

spent many hours on this crap, thx !

[FJCC]

This answer has made two happy on the same day! Thanks!

[Bok-GiUng]

I can't speak English well because I'm Korean, but I want to thank you. The hours with GPT5 were terrible. You saved my life.

[noamnelke]

Like many before me on this thread, this brought 4 gruelling hours with ChatGPT to an end. Thanks for taking the time to share your findings.

FWIW, I just used this in the checkout step, so all interactions use the token:

      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GH_TOKEN }}

[nikitaeverywhere]

Thanks for sharing this! Saved a few hours of debugging for sure.

[Nokel81]

Thank you sooo much!!! I have the same set up it seems where I call git ls-remote (with the auth in the URL) which would fail for private repos. But if I tried to clone a specific tag it would work.

[bloodearnest]

Thanks for this. We had accidentally included the .git/ dir in our docker image, and then git ls-remote was failing in production due to the cached credentials.

[AmitBenAmi]

Had this issue today as well, and I've been running within a Dockerfile and was passing the GITHUB_TOKEN as a secret to the action as an input - so I thought it doesn't even related - I'm not running the commands directly within the workflow.

Turning the persistency off solved my issue, so thanks!