[BUG]: git task fails on promisor fetch to fill in gaps due to no authorization

[richshadman]

What happened?

When using a pipeline that adds a fetch filter such as "blob:none", checkout that needs to perform "promisor fetches" to fill in commit history gaps fail due to no authorization header being sent.

I have a private project/repository I can grant guest access to to show reproduction. I have also outlined steps below to reproduce yourself:

1. Create a new repository, main branch, initialized with a "Readme".
2. Create a branch off of main, Edit the readme, add a new line of arbitrary text.
3. Add a yaml pipeline to this repository with the following:

name: Checkout Issue Repro

trigger: none

pool:
  vmImage: 'windows-latest'

jobs:
- job: CheckoutTest
  steps:
  - checkout: git://GitCheckoutIssue/GitCheckoutIssue@refs/heads/main
    fetchTags: false
    fetchFilter: blob:none
    displayName: Checkout Test - Main

  - checkout: self
    fetchTags: false
    displayName: Checkout Test - Self

4. Commit / Push changes
5. Switch back to main, edit readme, same line, different text
6. Commit / Push changes
7. Run the pipeline targeting the working branch

See the results:

I have also mentioned this in issue #4860 however that issue is closed and stale, so I am opening up this new ticket with direct steps to reproduce.

Some final notes below:

1. It won't occur on hosted agents without a workflow like the one I mentioned above as you need an environment where the git repo is already initialized with a fetch filter (partial clone) - my example explicitly uses blob:none
2. After that you need a checkout that needs commits not already pulled to the checked out repository to initiate a "promisor" fetch (read up on how git handles partial clones to understand this: https://git-scm.com/docs/partial-clone)
3. In my example, I have the 2 checkouts because our real world example is doing a diff between source and target during pull requests to find changed files. We must do a partial clone with the fetch filter because of the size of our history - slows things down tremendously otherwise.

Versions

Agent name: 'Hosted Agent'
Agent machine name: 'fv-az1379-631'
Current agent version: '4.251.0'
Operating System
Microsoft Windows Server 2022
10.0.20348
Datacenter
Runner Image
Image: windows-2022
Version: 20250303.1.0
Included Software: https://github.com/actions/runner-images/blob/win22/20250303.1/images/windows/Windows2022-Readme.md
Image Release: https://github.com/actions/runner-images/releases/tag/win22%2F20250303.1
Runner Image Provisioner
2.0.422.1
Current image version: '20250303.1.0'
Agent running as: 'VssAdministrator'

Task : Get sources
Description : Get sources from a repository. Supports Git, TfsVC, and SVN repositories.
Version : 1.0.0
Author : Microsoft
Help : More Information

git version
git version 2.47.0.windows.2
git lfs version
git-lfs/3.4.0 (GitHub; windows amd64; go 1.20.6; git d06d6e9e)

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

Microsoft Windows Server 2022 10.0.20348 Datacenter

Version controll system

azure git

Relevant log output

Starting: Checkout Test - Self
==============================================================================
Task         : Get sources
Description  : Get sources from a repository. Supports Git, TfsVC, and SVN repositories.
Version      : 1.0.0
Author       : Microsoft
Help         : [More Information](https://go.microsoft.com/fwlink/?LinkId=798199)
==============================================================================
Syncing repository: GitCheckoutIssue (Git)
Prepending Path environment variable with directory containing 'git.exe'.
git version
git version 2.47.0.windows.2
git lfs version
git-lfs/3.4.0 (GitHub; windows amd64; go 1.20.6; git d06d6e9e)
git config --get remote.origin.url
git clean -ffdx
git reset --hard HEAD
HEAD is now at cbb9ded * main changes that conflict with drift
git config gc.auto 0
git config core.longpaths true
git config --get-all http.https://xxx.visualstudio.com/xxx/_git/xxx.extraheader
git config --get-all http.extraheader
git config --get-regexp .*extraheader
git config --get-all http.proxy
git config http.version HTTP/1.1
git --config-env=http.extraheader=env_var_http.extraheader fetch --force --no-tags --prune --prune-tags --progress --no-recurse-submodules origin --depth=1  +a9e9229e984db6f5989a8ec0d29ea79500e566cd:refs/remotes/origin/a9e9229e984db6f5989a8ec0d29ea79500e566cd
remote: Azure Repos        
remote: 
remote: Found 0 objects to send. (0 ms)        
From https://xxx.visualstudio.com/xxx/_git/GitCheckoutIssue
 * [new ref]         a9e9229e984db6f5989a8ec0d29ea79500e566cd -> origin/a9e9229e984db6f5989a8ec0d29ea79500e566cd
git --config-env=http.extraheader=env_var_http.extraheader fetch --force --no-tags --prune --prune-tags --progress --no-recurse-submodules origin --depth=1  +a9e9229e984db6f5989a8ec0d29ea79500e566cd
remote: Azure Repos        
remote: 
remote: Found 0 objects to send. (0 ms)        
From https://xxx.visualstudio.com/xxx/_git/GitCheckoutIssue
 * branch            a9e9229e984db6f5989a8ec0d29ea79500e566cd -> FETCH_HEAD
git checkout --progress --force refs/remotes/origin/a9e9229e984db6f5989a8ec0d29ea79500e566cd
fatal: Cannot prompt because user interactivity has been disabled.
fatal: Cannot prompt because user interactivity has been disabled.
fatal: could not fetch 6a71b2f6ddb7efe80d6ee7dad18a1183a2cf36a3 from promisor remote
##[warning]Git checkout failed on shallow repository, this might because of git fetch with depth '1' doesn't include the checkout commit 'refs/remotes/origin/a9e9229e984db6f5989a8ec0d29ea79500e566cd'. Please reference documentation (http://go.microsoft.com/fwlink/?LinkId=829603)
##[error]Git checkout failed with exit code: 128
Finishing: Checkout Test - Self