Fix @claude branch push authentication

[d-morrison]

Summary

Follow-up to #523. The verification PR (#525) confirmed the @claude agent correctly checks out the PR branch and commits (the finding #1 concern), but the push failed on auth:

remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/UCD-SERG/serocalculator.git/'

After gh pr checkout (and the agent step's own git activity), actions/checkout's persisted credential extraheader isn't applied, so git push origin falls back to unsupported password auth.

Fix: push with an explicit https://x-access-token:${GH_TOKEN}@github.com/... URL in both push steps (PR-branch push and issue-branch push).

Test plan

• Merge, then re-trigger @claude on a PR (e.g. reopen the [verify] @claude PR-trigger path (do not merge) #525 path) and confirm the fix commit lands on the PR branch and a review is re-dispatched.

🤖 Generated with Claude Code

[claude]

Claude finished @d-morrison's task in 1m 7s —— View job

---

Code Review: PR #526 — Fix @claude branch push authentication

Summary: The fix is correct, minimal, and well-explained. No blocking issues found.

---

What the PR does

After gh pr checkout (or the agent step's own git activity), the actions/checkout-persisted http.extraheader credential is no longer applied, causing git push origin to fall back to unsupported password auth. The fix replaces both bare git push origin calls with an explicit https://x-access-token:${GH_TOKEN}@github.com/<repo>.git URL — the standard workaround for this class of GitHub Actions auth problem.

---

Review findings

No blocking issues. The two findings below are observations/minor suggestions only.

1. Token in the push URL — log masking is fine, but worth documenting

.github/workflows/claude.yml lines 270 and 440:

git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" ...

GH_TOKEN resolves from secrets.GITHUB_TOKEN, so GitHub Actions will mask the literal token value in log output. The URL won't be persisted to .git/config (it's an inline argument, not a git remote set-url call). This is the canonical pattern and is safe on ephemeral runners.

If you wanted to be extra careful against edge-case exposure (e.g. git printing the URL in a verbose error), you could use git remote set-url to swap the URL in and back out, or a url.<base>.insteadOf config block — but that's a quality-of-life preference, not a security requirement here.

2. Consistency with the git-push.sh helper

The claude-code-action harness ships a git-push.sh helper (used in these task instructions as /home/runner/work/_actions/anthropics/claude-code-action/v1/scripts/git-push.sh). It likely handles this same auth plumbing. Worth checking whether that script would have fixed the PR-branch push too, or whether the two push steps in this file intentionally do their own thing because they happen in workflow post-steps outside the agent's context. No action needed — just something to verify if the fix is ever revisited.

---

Positive notes

• Both push sites are updated consistently (PR-branch at line 270, issue-branch at line 440).
• GH_TOKEN is correctly declared in env: for both steps (lines 247 and 427).
• Comments at lines 263–269 and 418–421 clearly explain the root cause so future readers don't have to rediscover it.
• The earlier comment at line 415 ("The checkout uses the persisted GITHUB_TOKEN, so a plain git push origin authenticates.") is correctly updated to remove the now-false claim.
• Fork guard (lines 257–260) is unaffected — the fork-push warning still fires before the new push URL would be reached, which is the right behavior.

---

Verdict: Approve and merge. The fix is correct and the PR is clean.

[Copilot]

Pull request overview

Fixes authentication failures when the @claude workflow pushes commits back to GitHub after gh pr checkout, by switching both push paths to use an explicit x-access-token HTTPS remote URL instead of relying on actions/checkout persisted credentials.

Changes:

• Update the PR-branch push step to git push via https://x-access-token:${GH_TOKEN}@github.com/....
• Update the issue-trigger branch push step to use the same explicit token URL.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.