[TT-17030] Fix git auth: use x-access-token prefix for GitHub App tokens

[buger]

Summary

• Fix git config insteadOf pattern in godoc.yml and nancy.yaml to use x-access-token: prefix and trailing slashes
• The bare token pattern fails when actions/checkout has set up a credential helper; the x-access-token: prefix ensures the URL rewrite takes precedence
• Also fixes the legacy x-oauth-basic credential pattern in nancy.yaml

Files changed

• .github/workflows/godoc.yml — 1 replacement
• .github/workflows/nancy.yaml — 2 replacements (insteadOf + git-credentials)

Test plan

• Verify godoc workflow runs successfully with private Go module deps
• Verify nancy workflow can resolve private Go modules for scanning

🤖 Generated with Claude Code

[probelabs]

This PR fixes a Git authentication issue in the godoc and nancy GitHub Actions workflows when fetching private Go modules. The previous method, using a bare token in the URL, conflicts with the credential helper set up by the actions/checkout action, causing authentication to fail.

The fix replaces the bare token and an outdated x-oauth-basic pattern with the https://x-access-token:TOKEN@github.com/ format. This is the modern, recommended approach for using GitHub App tokens for Git authentication in workflows, as it takes precedence over other credential helpers. The git config insteadOf rules were also updated with trailing slashes for more robust URL matching.

Files Changed Analysis

• .github/workflows/godoc.yml: The git config command was updated to use the x-access-token prefix and a trailing slash in the URL.
• .github/workflows/nancy.yaml: Both the .git-credentials entry and the git config command were updated from the legacy x-oauth-basic format to the new x-access-token format.

The changes are minimal and consistent across both files, targeting only the authentication mechanism.

Architecture & Impact Assessment

• What this PR accomplishes: It resolves a bug that prevented CI workflows from accessing private Go dependencies, unblocking the godoc generation and nancy vulnerability scanning jobs.
• Key technical changes:
  • Replaced bare token and x-oauth-basic authentication with the x-access-token prefix for GitHub App tokens.
  • Updated git config --global url.insteadOf patterns to use the new prefix and trailing slashes for correctness.
• Affected system components: The impact is limited to the CI/CD environment, specifically affecting the godoc and nancy GitHub Actions workflows. There are no changes to the application source code.

Scope Discovery & Context Expansion

• The changes are scoped to workflow configuration. However, this pattern of authentication for private Go modules might be present in other workflows. A search across the .github/workflows/ directory for other instances of git config --global url.insteadOf or hardcoded x-oauth-basic credentials would be prudent to ensure all workflows are standardized and fixed.

Metadata

• Review Effort: 1 / 5
• Primary Label: bug

---

Powered by Visor from Probelabs

Last updated: 2026-04-23T09:54:38.998Z | Triggered by: pr_opened | Commit: 3ba477f

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-04-23T09:54:26.867Z | Triggered by: pr_opened | Commit: 3ba477f

💡 TIP: You can chat with Visor using /visor ask <your question>