fix(pinact): git auth

ReenigneArcher · ReenigneArcher · commit 42d8ce443cad · 2026-02-02T20:36:28.000-05:00
diff --git a/actions/pinact/pinact.js b/actions/pinact/pinact.js
@@ -240,12 +240,18 @@ function configureGit(repoPath, authorName, authorEmail) {
 /**
  * Create a branch, commit changes, and push
  * @param {string} repoPath - Path to the repository
- * @param {string} branchName - Name of the branch to create
- * @param {string} authorName - Git author name
- * @param {string} authorEmail - Git author email
- * @param {boolean} dryRun - Whether this is a dry run
+ * @param {Object} options - Commit and push options
+ * @param {string} options.branchName - Name of the branch to create
+ * @param {string} options.authorName - Git author name
+ * @param {string} options.authorEmail - Git author email
+ * @param {boolean} options.dryRun - Whether this is a dry run
+ * @param {string} options.owner - Repository owner
+ * @param {string} options.repo - Repository name
+ * @param {string} options.token - GitHub token for authentication
  */
-function commitAndPush(repoPath, branchName, authorName, authorEmail, dryRun) {
+function commitAndPush(repoPath, options) {
+  const { branchName, authorName, authorEmail, dryRun, owner, repo, token } = options;
+
   Logger.log('Creating branch and committing changes...');
 
   configureGit(repoPath, authorName, authorEmail);
@@ -264,8 +270,12 @@ function commitAndPush(repoPath, branchName, authorName, authorEmail, dryRun) {
     Logger.info('🔍 DRY RUN: Would push to branch: ' + branchName + ' (skipping)');
     Logger.log('');
   } else {
+    // Set remote URL with token to ensure authentication works
+    const repoUrl = 'https://x-access-token:' + token + '@github.com/' + owner + '/' + repo + '.git';
+    execCommand('git remote set-url origin ' + repoUrl, { cwd: repoPath });
+
     // Push branch
-    execCommand('git push origin ' + branchName, { cwd: repoPath });
+    execCommand('git push -u origin ' + branchName, { cwd: repoPath });
     Logger.success('✅ Changes committed and pushed to branch: ' + branchName);
     Logger.log('');
   }
@@ -328,7 +338,8 @@ async function createPullRequest(github, owner, repo, branchName, defaultBranch,
   const title = 'chore: update GitHub Actions to use commit hashes';
   const body = `This PR updates GitHub Actions to use commit hashes instead of tags for improved security.
 
-Changes were automatically generated by [pinact](https://github.com/suzuki-shunsuke/pinact).
+Changes were automatically generated by [pinact](https://github.com/suzuki-shunsuke/pinact)
+and the LizardByte/actions [pinact action](https://github.com/LizardByte/actions/tree/master/actions/pinact).
 
 ## Benefits
 - Prevents tag hijacking attacks
@@ -489,7 +500,15 @@ async function processRepository(github, options) {
 
     if (hasChanges) {
       // Commit and push changes
-      commitAndPush(repoPath, branchName, authorName, authorEmail, dryRun);
+      commitAndPush(repoPath, {
+        branchName,
+        authorName,
+        authorEmail,
+        dryRun,
+        owner,
+        repo,
+        token
+      });
 
       // Create pull request
       await createPullRequest(github, owner, repo, branchName, defaultBranch, dryRun);
@@ -735,7 +754,7 @@ async function runPinactAction({ github, context, core }) {
   const pinactVersion = process.env.INPUT_PINACT_VERSION;
   const prBranchName = process.env.INPUT_PR_BRANCH_NAME;
   const repo = process.env.INPUT_REPO;
-  const token = process.env.GITHUB_TOKEN || process.env.INPUT_TOKEN;
+  const token = process.env.PINACT_GITHUB_TOKEN || process.env.INPUT_TOKEN || process.env.GITHUB_TOKEN;
 
   printActionConfig({
     dryRun,
