build(deps-dev): bump undici from 6.28.0 to 6.29.0 (#4478)

Bumps [undici](https://github.com/nodejs/undici) from 6.28.0 to 6.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.28.0...v6.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.29.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/dependabot.yml

@@ -5,6 +5,8 @@ updates:
     schedule:
       interval: "monthly"
       day: "tuesday"
+    cooldown:
+      default-days: 3
     labels:
       - "dependencies"
     groups:
@@ -17,6 +19,8 @@ updates:
     schedule:
       interval: "monthly"
       day: "tuesday"
+    cooldown:
+      default-days: 3
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]

.github/workflows/automerge-dependabot.yml

@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.actor == 'dependabot[bot]'
     steps:
-      - uses: peter-evans/enable-pull-request-automerge@v3
+      - uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
         with:
           token: ${{ secrets.ACTIONS_BOT_TOKEN }}
           pull-request-number: ${{ github.event.pull_request.number }}

.github/workflows/ci.yml

@@ -19,8 +19,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: package.json
           cache: npm
@@ -29,11 +29,11 @@ jobs:
       - run: npm run format-check
       - run: npm run lint
       - run: npm run test
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist
           path: dist
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: action.yml
           path: action.yml
@@ -46,16 +46,16 @@ jobs:
       matrix:
         target: [built, committed]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
       - if: matrix.target == 'built' || github.event_name == 'pull_request'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist
       - if: matrix.target == 'built' || github.event_name == 'pull_request'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: action.yml
           path: .
@@ -80,7 +80,7 @@ jobs:
           branch: ci-test-${{ matrix.target }}-${{ github.sha }}
 
       - name: Close Pull
-        uses: peter-evans/close-pull@v3
+        uses: peter-evans/close-pull@a192af8d70f2d49c49643134605c3b73d4f80fae # v3.0.1
         with:
           pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
           comment: '[CI] test ${{ matrix.target }}'
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Find Comment
-        uses: peter-evans/find-comment@v4
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
         id: fc
         with:
           issue-number: ${{ github.event.number }}
@@ -101,7 +101,7 @@ jobs:
 
       - if: steps.fc.outputs.comment-id == ''
         name: Create comment
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           issue-number: ${{ github.event.number }}
           body: |
@@ -118,13 +118,13 @@ jobs:
     needs: [test]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.ACTIONS_BOT_TOKEN }}
           commit-message: 'build: update distribution'

.github/workflows/cpr-example-command.yml

@@ -6,7 +6,7 @@ jobs:
   createPullRequest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Make changes to pull request
         run: date +%s > report.txt
@@ -42,7 +42,7 @@ jobs:
           echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"
 
       - name: Add reaction
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
           comment-id: ${{ github.event.client_payload.github.payload.comment.id }}

.github/workflows/slash-command-dispatch.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Slash Command Dispatch
-        uses: peter-evans/slash-command-dispatch@v5
+        uses: peter-evans/slash-command-dispatch@9bdcd7914ec1b75590b790b844aa3b8eee7c683a # v5.0.2
         with:
           token: ${{ secrets.ACTIONS_BOT_TOKEN }}
           config: >

.github/workflows/update-major-version.yml

@@ -18,7 +18,7 @@ jobs:
   tag:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         token: ${{ secrets.ACTIONS_BOT_TOKEN }}
         fetch-depth: 0
@@ -27,6 +27,11 @@ jobs:
         git config user.name actions-bot
         git config user.email actions-bot@users.noreply.github.com
     - name: Tag new target
-      run: git tag -f ${{ github.event.inputs.main_version }} ${{ github.event.inputs.target }}
+      run: git tag -f "${INPUT_MAIN_VERSION}" "${INPUT_TARGET}"
+      env:
+        INPUT_MAIN_VERSION: ${{ github.event.inputs.main_version }}
+        INPUT_TARGET: ${{ github.event.inputs.target }}
     - name: Push new tag
-      run: git push origin ${{ github.event.inputs.main_version }} --force
+      run: git push origin "${INPUT_MAIN_VERSION}" --force
+      env:
+        INPUT_MAIN_VERSION: ${{ github.event.inputs.main_version }}

__test__/create-or-update-branch.int.test.ts

@@ -4,10 +4,10 @@ import {
   getWorkingBaseAndType,
   buildBranchCommits
 } from '../lib/create-or-update-branch'
+import {randomUUID} from 'crypto'
 import * as fs from 'fs'
 import {GitCommandManager} from '../lib/git-command-manager'
 import * as path from 'path'
-import {v4 as uuidv4} from 'uuid'
 
 const REPO_PATH = '/git/local/repos/test-base'
 const REMOTE_NAME = 'origin'
@@ -31,7 +31,7 @@ const ADD_PATHS_MULTI = ['a', 'b']
 const ADD_PATHS_WILDCARD = ['a/*.txt', 'b/*.txt']
 
 async function createFile(filename: string, content?: string): Promise<string> {
-  const _content = content ? content : uuidv4()
+  const _content = content ? content : randomUUID()
   const filepath = path.join(REPO_PATH, filename)
   await fs.promises.mkdir(path.dirname(filepath), {recursive: true})
   await fs.promises.writeFile(filepath, _content, {encoding: 'utf8'})
@@ -82,7 +82,7 @@ async function createCommits(
     } else {
       result.changes = await createChanges()
     }
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     await git.exec(['add', '-A'])
     await git.commit(['-m', commitMessage])
     result.commitMsgs.unshift(commitMessage)
@@ -313,7 +313,7 @@ describe('create-or-update-branch tests', () => {
   })
 
   it('tests no changes resulting in no new branch being created', async () => {
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -330,7 +330,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create and update with a tracked file change', async () => {
     // Create a tracked file change
     const trackedContent = await createFile(TRACKED_FILE)
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -359,7 +359,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create a tracked file change
     const _trackedContent = await createFile(TRACKED_FILE)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -381,7 +381,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create and update with an untracked file change', async () => {
     // Create an untracked file change
     const untrackedContent = await createFile(UNTRACKED_FILE)
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -410,7 +410,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create an untracked file change
     const _untrackedContent = await createFile(UNTRACKED_FILE)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -434,7 +434,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -464,7 +464,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create identical tracked and untracked file changes
     await createChanges(changes.tracked, changes.untracked)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -486,7 +486,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create and update with commits on the base inbetween', async () => {
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -524,7 +524,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -556,7 +556,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -585,7 +585,7 @@ describe('create-or-update-branch tests', () => {
     await beforeTest()
 
     // Running with no update effectively reverts the branch back to match the base
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -607,7 +607,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -648,7 +648,7 @@ describe('create-or-update-branch tests', () => {
       commits.changes.tracked,
       commits.changes.untracked
     )
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -673,7 +673,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -703,7 +703,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create a commit on the base with a partial merge of the changes
     await createFile(TRACKED_FILE, changes.tracked)
-    const baseCommitMessage = uuidv4()
+    const baseCommitMessage = randomUUID()
     await git.exec(['add', '-A'])
     await git.commit(['-m', baseCommitMessage])
     await git.push([
@@ -714,7 +714,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create the same tracked and untracked file changes
     const _changes = await createChanges(changes.tracked, changes.untracked)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -746,7 +746,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -790,7 +790,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create the same tracked and untracked file changes (no change on update)
     const _changes = await createChanges(changes.tracked, changes.untracked)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -816,7 +816,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -845,7 +845,7 @@ describe('create-or-update-branch tests', () => {
     await beforeTest()
 
     // Force push the base branch to a different commit
-    const amendedCommitMessage = uuidv4()
+    const amendedCommitMessage = randomUUID()
     await git.commit(['--amend', '-m', amendedCommitMessage])
     await git.push([
       '--force',
@@ -855,7 +855,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create the same tracked and untracked file changes (no change on update)
     const _changes = await createChanges(changes.tracked, changes.untracked)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -878,7 +878,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create and update with commits on the working base (during the workflow)', async () => {
     // Create commits on the working base
     const commits = await createCommits(git)
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -910,7 +910,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create commits on the working base
     const _commits = await createCommits(git)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -937,7 +937,7 @@ describe('create-or-update-branch tests', () => {
     const commits = await createCommits(git)
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -973,7 +973,7 @@ describe('create-or-update-branch tests', () => {
     const _commits = await createCommits(git)
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1002,7 +1002,7 @@ describe('create-or-update-branch tests', () => {
     const commits = await createCommits(git)
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1046,7 +1046,7 @@ describe('create-or-update-branch tests', () => {
     const _commits = await createCommits(git)
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1074,7 +1074,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create and update using a different remote from the base', async () => {
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1104,7 +1104,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1127,7 +1127,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create and update with signoff on commit', async () => {
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1164,7 +1164,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1194,7 +1194,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create and update with multiple add-paths', async () => {
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1224,7 +1224,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1247,7 +1247,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create and update with wildcard add-paths', async () => {
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1277,7 +1277,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1300,7 +1300,7 @@ describe('create-or-update-branch tests', () => {
   it('tests create with add-paths resolving to no changes when other changes exist', async () => {
     // Create tracked and untracked file changes
     await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1321,7 +1321,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const resultA = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1365,7 +1365,7 @@ describe('create-or-update-branch tests', () => {
     // Set the working base to a branch that is not the pull request base
     await git.checkout(NOT_BASE_BRANCH)
 
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1386,7 +1386,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create a tracked file change
     const trackedContent = await createFile(TRACKED_FILE)
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1418,7 +1418,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create a tracked file change
     const _trackedContent = await createFile(TRACKED_FILE)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1443,7 +1443,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create an untracked file change
     const untrackedContent = await createFile(UNTRACKED_FILE)
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1475,7 +1475,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create an untracked file change
     const _untrackedContent = await createFile(UNTRACKED_FILE)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1502,7 +1502,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1535,7 +1535,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create identical tracked and untracked file changes
     await createChanges(changes.tracked, changes.untracked)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1560,7 +1560,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1601,7 +1601,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1635,7 +1635,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1667,7 +1667,7 @@ describe('create-or-update-branch tests', () => {
     await git.checkout(NOT_BASE_BRANCH)
 
     // Running with no update effectively reverts the branch back to match the base
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1694,7 +1694,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1738,7 +1738,7 @@ describe('create-or-update-branch tests', () => {
       commits.changes.tracked,
       commits.changes.untracked
     )
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1768,7 +1768,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1798,7 +1798,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create a commit on the base with a partial merge of the changes
     await createFile(TRACKED_FILE, changes.tracked)
-    const baseCommitMessage = uuidv4()
+    const baseCommitMessage = randomUUID()
     await git.exec(['add', '-A'])
     await git.commit(['-m', baseCommitMessage])
     await git.push([
@@ -1812,7 +1812,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create the same tracked and untracked file changes
     const _changes = await createChanges(changes.tracked, changes.untracked)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1846,7 +1846,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1893,7 +1893,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create the same tracked and untracked file changes (no change on update)
     const _changes = await createChanges(changes.tracked, changes.untracked)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1924,7 +1924,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -1953,7 +1953,7 @@ describe('create-or-update-branch tests', () => {
     await beforeTest()
 
     // Force push the base branch to a different commit
-    const amendedCommitMessage = uuidv4()
+    const amendedCommitMessage = randomUUID()
     await git.commit(['--amend', '-m', amendedCommitMessage])
     await git.push([
       '--force',
@@ -1966,7 +1966,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create the same tracked and untracked file changes (no change on update)
     const _changes = await createChanges(changes.tracked, changes.untracked)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -1992,7 +1992,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create commits on the working base
     const commits = await createCommits(git)
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -2027,7 +2027,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create commits on the working base
     const _commits = await createCommits(git)
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -2057,7 +2057,7 @@ describe('create-or-update-branch tests', () => {
     const commits = await createCommits(git)
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -2096,7 +2096,7 @@ describe('create-or-update-branch tests', () => {
     const _commits = await createCommits(git)
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -2128,7 +2128,7 @@ describe('create-or-update-branch tests', () => {
     const commits = await createCommits(git)
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -2175,7 +2175,7 @@ describe('create-or-update-branch tests', () => {
     const _commits = await createCommits(git)
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -2205,7 +2205,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -2238,7 +2238,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -2268,7 +2268,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -2302,7 +2302,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -2329,7 +2329,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -2371,7 +2371,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const _changes = await createChanges()
-    const _commitMessage = uuidv4()
+    const _commitMessage = randomUUID()
     const _result = await createOrUpdateBranch(
       git,
       _commitMessage,
@@ -2403,7 +2403,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create commits on the working base
     const commits = await createCommits(git)
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const result = await createOrUpdateBranch(
       git,
       commitMessage,
@@ -2428,7 +2428,7 @@ describe('create-or-update-branch tests', () => {
 
     // Create tracked and untracked file changes
     const changes = await createChanges()
-    const commitMessage = uuidv4()
+    const commitMessage = randomUUID()
     const resultA = await createOrUpdateBranch(
       git,
       commitMessage,

__test__/git-config-helper.int.test.ts

@@ -1,7 +1,5 @@
 import {GitCommandManager} from '../lib/git-command-manager'
 import {GitConfigHelper} from '../lib/git-config-helper'
-import * as fs from 'fs'
-import * as path from 'path'
 
 const REPO_PATH = '/git/local/repos/test-base'
 
@@ -9,104 +7,29 @@ const extraheaderConfigKey = 'http.https://127.0.0.1/.extraheader'
 
 describe('git-config-helper integration tests', () => {
   let git: GitCommandManager
-  let originalRunnerTemp: string | undefined
 
   beforeAll(async () => {
     git = await GitCommandManager.create(REPO_PATH)
   })
 
-  beforeEach(async () => {
-    // Save original RUNNER_TEMP
-    originalRunnerTemp = process.env['RUNNER_TEMP']
-    // Create a temp directory for tests
-    const tempDir = await fs.promises.mkdtemp('/tmp/cpr-test-')
-    process.env['RUNNER_TEMP'] = tempDir
-    process.env['GITHUB_WORKSPACE'] = REPO_PATH
-  })
-
-  afterEach(async () => {
-    // Clean up RUNNER_TEMP
-    const runnerTemp = process.env['RUNNER_TEMP']
-    if (runnerTemp && runnerTemp.startsWith('/tmp/cpr-test-')) {
-      await fs.promises.rm(runnerTemp, {recursive: true, force: true})
-    }
-    // Restore original RUNNER_TEMP
-    if (originalRunnerTemp !== undefined) {
-      process.env['RUNNER_TEMP'] = originalRunnerTemp
-    } else {
-      delete process.env['RUNNER_TEMP']
-    }
-  })
-
   it('tests save and restore with no persisted auth', async () => {
     const gitConfigHelper = await GitConfigHelper.create(git)
     await gitConfigHelper.close()
   })
 
-  it('tests configure and removal of auth using credentials file', async () => {
-    const runnerTemp = process.env['RUNNER_TEMP']!
+  it('tests configure and removal of auth', async () => {
     const gitConfigHelper = await GitConfigHelper.create(git)
     await gitConfigHelper.configureToken('github-token')
-
-    // Verify credentials file was created in RUNNER_TEMP
-    const files = await fs.promises.readdir(runnerTemp)
-    const credentialsFiles = files.filter(
-      f => f.startsWith('git-credentials-') && f.endsWith('.config')
-    )
-    expect(credentialsFiles.length).toBe(1)
-
-    // Verify credentials file contains the auth token
-    const credentialsPath = path.join(runnerTemp, credentialsFiles[0])
-    const credentialsContent = await fs.promises.readFile(
-      credentialsPath,
-      'utf8'
-    )
-    expect(credentialsContent).toContain(
+    expect(await git.configExists(extraheaderConfigKey)).toBeTruthy()
+    expect(await git.getConfigValue(extraheaderConfigKey)).toEqual(
       'AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2l0aHViLXRva2Vu'
     )
 
-    // Verify includeIf entries were added to local config
-    const includeIfKeys = await git.tryGetConfigKeys('^includeIf\\.gitdir:')
-    expect(includeIfKeys.length).toBeGreaterThan(0)
-
-    // Count credential includes pointing to this action's credentials file
-    let credentialIncludesForThisAction = 0
-    for (const key of includeIfKeys) {
-      const values = await git.tryGetConfigValues(key)
-      for (const value of values) {
-        if (value === credentialsPath) {
-          credentialIncludesForThisAction++
-        }
-      }
-    }
-    expect(credentialIncludesForThisAction).toBeGreaterThan(0)
-
     await gitConfigHelper.close()
-
-    // Verify credentials file was removed
-    const filesAfter = await fs.promises.readdir(runnerTemp)
-    const credentialsFilesAfter = filesAfter.filter(
-      f => f.startsWith('git-credentials-') && f.endsWith('.config')
-    )
-    expect(credentialsFilesAfter.length).toBe(0)
-
-    // Verify includeIf entries pointing to our specific credentials file were removed
-    const includeIfKeysAfter = await git.tryGetConfigKeys(
-      '^includeIf\\.gitdir:'
-    )
-    let credentialIncludesForThisActionAfter = 0
-    for (const key of includeIfKeysAfter) {
-      const values = await git.tryGetConfigValues(key)
-      for (const value of values) {
-        if (value === credentialsPath) {
-          credentialIncludesForThisActionAfter++
-        }
-      }
-    }
-    expect(credentialIncludesForThisActionAfter).toBe(0)
+    expect(await git.configExists(extraheaderConfigKey)).toBeFalsy()
   })
 
-  it('tests save and restore of persisted auth (old-style)', async () => {
+  it('tests save and restore of persisted auth', async () => {
     const extraheaderConfigValue = 'AUTHORIZATION: basic ***persisted-auth***'
     await git.config(extraheaderConfigKey, extraheaderConfigValue)
 

__test__/integration-tests.sh

@@ -10,7 +10,7 @@ if [[ "$(docker images -q $IMAGE 2> /dev/null)" == "" || $ARG1 == "build" ]]; th
     cat > Dockerfile << EOF
 FROM node:20-alpine
 RUN apk --no-cache add git git-daemon
-RUN npm install jest jest-environment-jsdom --global
+RUN npm install jest@30 jest-environment-jsdom@30 --global
 WORKDIR /cpr
 COPY __test__/entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]

__test__/utils.unit.test.ts

@@ -118,3 +118,71 @@ describe('utils tests', () => {
     }
   })
 })
+
+describe('retryWithBackoff', () => {
+  const makeConsistencyError = () => {
+    const error = new Error(
+      'Validation Failed: "Could not resolve to a node with the global id of \'PR_abc123\'."'
+    )
+    ;(error as any).status = 422
+    return error
+  }
+
+  const shouldRetry = (e: unknown): boolean =>
+    e instanceof Error &&
+    (e as any).status === 422 &&
+    e.message.includes('Could not resolve to a node')
+
+  test('succeeds on first attempt without retrying', async () => {
+    const fn = jest.fn().mockResolvedValue('success')
+    const result = await utils.retryWithBackoff(fn, shouldRetry, 2, 1)
+    expect(result).toBe('success')
+    expect(fn).toHaveBeenCalledTimes(1)
+  })
+
+  test('retries on eventual consistency 422 and succeeds', async () => {
+    const fn = jest
+      .fn()
+      .mockRejectedValueOnce(makeConsistencyError())
+      .mockResolvedValue('success')
+    const result = await utils.retryWithBackoff(fn, shouldRetry, 2, 1)
+    expect(result).toBe('success')
+    expect(fn).toHaveBeenCalledTimes(2)
+  })
+
+  test('exhausts retries on persistent 422 and throws', async () => {
+    const fn = jest.fn().mockRejectedValue(makeConsistencyError())
+    await expect(utils.retryWithBackoff(fn, shouldRetry, 2, 1)).rejects.toThrow(
+      'Could not resolve to a node'
+    )
+    expect(fn).toHaveBeenCalledTimes(3) // 1 initial + 2 retries
+  })
+
+  test('does not retry on non-422 errors', async () => {
+    const error = new Error('Forbidden')
+    ;(error as any).status = 403
+    const fn = jest.fn().mockRejectedValue(error)
+    await expect(utils.retryWithBackoff(fn, shouldRetry, 2, 1)).rejects.toThrow(
+      'Forbidden'
+    )
+    expect(fn).toHaveBeenCalledTimes(1)
+  })
+
+  test('does not retry on 422 without the consistency error message', async () => {
+    const error = new Error('Validation Failed: invalid label')
+    ;(error as any).status = 422
+    const fn = jest.fn().mockRejectedValue(error)
+    await expect(utils.retryWithBackoff(fn, shouldRetry, 2, 1)).rejects.toThrow(
+      'Validation Failed: invalid label'
+    )
+    expect(fn).toHaveBeenCalledTimes(1)
+  })
+
+  test('does not retry on plain Error objects', async () => {
+    const fn = jest.fn().mockRejectedValue(new Error('Something broke'))
+    await expect(utils.retryWithBackoff(fn, shouldRetry, 2, 1)).rejects.toThrow(
+      'Something broke'
+    )
+    expect(fn).toHaveBeenCalledTimes(1)
+  })
+})

jest.config.js

@@ -3,7 +3,7 @@ module.exports = {
   moduleFileExtensions: ['js', 'ts'],
   testEnvironment: 'node',
   testMatch: ['**/*.test.ts'],
-  testRunner: 'jest-circus/runner',
+
   transform: {
     '^.+\\.ts$': 'ts-jest'
   },

package.json

@@ -39,29 +39,28 @@
     "@octokit/plugin-rest-endpoint-methods": "^13.5.0",
     "@octokit/plugin-retry": "^7.2.1",
     "@octokit/plugin-throttling": "^9.6.1",
+    "@octokit/request-error": "^6.1.8",
     "node-fetch-native": "^1.6.7",
-    "p-limit": "^6.2.0",
-    "uuid": "^9.0.1"
+    "p-limit": "^6.2.0"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.14",
+    "@types/jest": "^30.0.0",
     "@types/node": "^18.19.130",
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
-    "@vercel/ncc": "^0.38.4",
+    "@vercel/ncc": "^0.45.0",
     "eslint": "^8.57.1",
     "eslint-import-resolver-typescript": "^3.10.1",
     "eslint-plugin-github": "^4.10.2",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-jest": "^27.9.0",
-    "eslint-plugin-prettier": "^5.5.4",
-    "jest": "^29.7.0",
-    "jest-circus": "^29.7.0",
-    "jest-environment-jsdom": "^29.7.0",
-    "js-yaml": "^4.1.1",
-    "prettier": "^3.7.4",
-    "ts-jest": "^29.4.6",
+    "eslint-plugin-prettier": "^5.5.6",
+    "jest": "^30.5.0",
+    "jest-environment-jsdom": "^30.5.0",
+    "js-yaml": "^5.4.1",
+    "prettier": "^3.9.6",
+    "ts-jest": "^29.4.12",
     "typescript": "^5.9.3",
-    "undici": "^6.23.0"
+    "undici": "^6.29.0"
   }
 }

src/create-or-update-branch.ts

@@ -1,6 +1,6 @@
 import * as core from '@actions/core'
+import {randomUUID} from 'crypto'
 import {GitCommandManager, Commit} from './git-command-manager'
-import {v4 as uuidv4} from 'uuid'
 import * as utils from './utils'
 
 const CHERRYPICK_EMPTY =
@@ -189,7 +189,7 @@ export async function createOrUpdateBranch(
   const baseRemote = 'origin'
 
   // Save the working base changes to a temporary branch
-  const tempBranch = uuidv4()
+  const tempBranch = randomUUID()
   await git.checkout(tempBranch, 'HEAD')
   // Commit any uncommitted changes
   if (await git.isDirty(true, addPaths)) {

src/git-command-manager.ts

@@ -96,15 +96,9 @@ export class GitCommandManager {
     configKey: string,
     configValue: string,
     globalConfig?: boolean,
-    add?: boolean,
-    configFile?: string
+    add?: boolean
   ): Promise<void> {
-    const args: string[] = ['config']
-    if (configFile) {
-      args.push('--file', configFile)
-    } else {
-      args.push(globalConfig ? '--global' : '--local')
-    }
+    const args: string[] = ['config', globalConfig ? '--global' : '--local']
     if (add) {
       args.push('--add')
     }
@@ -356,67 +350,6 @@ export class GitCommandManager {
     return output.exitCode === 0
   }
 
-  async tryConfigUnsetValue(
-    configKey: string,
-    configValue: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<boolean> {
-    const args = ['config']
-    if (configFile) {
-      args.push('--file', configFile)
-    } else {
-      args.push(globalConfig ? '--global' : '--local')
-    }
-    args.push('--fixed-value', '--unset', configKey, configValue)
-    const output = await this.exec(args, {allowAllExitCodes: true})
-    return output.exitCode === 0
-  }
-
-  async tryGetConfigValues(
-    configKey: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<string[]> {
-    const args = ['config']
-    if (configFile) {
-      args.push('--file', configFile)
-    } else {
-      args.push(globalConfig ? '--global' : '--local')
-    }
-    args.push('--get-all', configKey)
-    const output = await this.exec(args, {allowAllExitCodes: true})
-    if (output.exitCode !== 0) {
-      return []
-    }
-    return output.stdout
-      .trim()
-      .split('\n')
-      .filter(value => value.trim())
-  }
-
-  async tryGetConfigKeys(
-    pattern: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<string[]> {
-    const args = ['config']
-    if (configFile) {
-      args.push('--file', configFile)
-    } else {
-      args.push(globalConfig ? '--global' : '--local')
-    }
-    args.push('--name-only', '--get-regexp', pattern)
-    const output = await this.exec(args, {allowAllExitCodes: true})
-    if (output.exitCode !== 0) {
-      return []
-    }
-    return output.stdout
-      .trim()
-      .split('\n')
-      .filter(key => key.trim())
-  }
-
   async tryGetRemoteUrl(): Promise<string> {
     const output = await this.exec(
       ['config', '--local', '--get', 'remote.origin.url'],

src/git-config-helper.ts

@@ -4,7 +4,6 @@ import {GitCommandManager} from './git-command-manager'
 import * as path from 'path'
 import {URL} from 'url'
 import * as utils from './utils'
-import {v4 as uuid} from 'uuid'
 
 interface GitRemote {
   hostname: string
@@ -14,6 +13,7 @@ interface GitRemote {
 
 export class GitConfigHelper {
   private git: GitCommandManager
+  private gitConfigPath = ''
   private workingDirectory: string
   private safeDirectoryConfigKey = 'safe.directory'
   private safeDirectoryAdded = false
@@ -22,8 +22,7 @@ export class GitConfigHelper {
   private extraheaderConfigPlaceholderValue = 'AUTHORIZATION: basic ***'
   private extraheaderConfigValueRegex = '^AUTHORIZATION:'
   private persistedExtraheaderConfigValue = ''
-  // Path to the credentials config file in RUNNER_TEMP (new v6-style auth)
-  private credentialsConfigPath = ''
+  private backedUpCredentialFiles: string[] = []
 
   private constructor(git: GitCommandManager) {
     this.git = git
@@ -123,14 +122,15 @@ export class GitConfigHelper {
   async savePersistedAuth(): Promise<void> {
     const serverUrl = new URL(`https://${this.getGitRemote().hostname}`)
     this.extraheaderConfigKey = `http.${serverUrl.origin}/.extraheader`
-    // Save and unset persisted extraheader credential in git config if it exists (old-style auth)
-    // Note: checkout@v6 uses credentials files with includeIf, so we don't need to
-    // manipulate those - they work independently via git's include mechanism
+    // Backup checkout@v6 credential files if they exist
+    await this.hideCredentialFiles()
+    // Save and unset persisted extraheader credential in git config if it exists
     this.persistedExtraheaderConfigValue = await this.getAndUnset()
   }
 
   async restorePersistedAuth(): Promise<void> {
-    // Restore old-style extraheader config if it was persisted
+    // Restore checkout@v6 credential files if they were backed up
+    await this.unhideCredentialFiles()
     if (this.persistedExtraheaderConfigValue) {
       try {
         await this.setExtraheaderConfig(this.persistedExtraheaderConfigValue)
@@ -142,218 +142,81 @@ export class GitConfigHelper {
   }
 
   async configureToken(token: string): Promise<void> {
-    // Encode the basic credential for HTTPS access
+    // Encode and configure the basic credential for HTTPS access
     const basicCredential = Buffer.from(
       `x-access-token:${token}`,
       'utf8'
     ).toString('base64')
     core.setSecret(basicCredential)
     const extraheaderConfigValue = `AUTHORIZATION: basic ${basicCredential}`
-
-    // Get or create the credentials config file path
-    const credentialsConfigPath = this.getCredentialsConfigPath()
-
-    // Write placeholder to the separate credentials config file using git config.
-    // This approach avoids the credential being captured by process creation audit events,
-    // which are commonly logged. For more information, refer to
-    // https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
-    await this.git.config(
-      this.extraheaderConfigKey,
-      this.extraheaderConfigPlaceholderValue,
-      false, // globalConfig
-      false, // add
-      credentialsConfigPath
-    )
-
-    // Replace the placeholder in the credentials config file
-    let content = (await fs.promises.readFile(credentialsConfigPath)).toString()
-    const placeholderIndex = content.indexOf(
-      this.extraheaderConfigPlaceholderValue
-    )
-    if (
-      placeholderIndex < 0 ||
-      placeholderIndex !=
-        content.lastIndexOf(this.extraheaderConfigPlaceholderValue)
-    ) {
-      throw new Error(
-        `Unable to replace auth placeholder in ${credentialsConfigPath}`
-      )
-    }
-    content = content.replace(
-      this.extraheaderConfigPlaceholderValue,
-      extraheaderConfigValue
-    )
-    await fs.promises.writeFile(credentialsConfigPath, content)
-
-    // Configure includeIf entries to reference the credentials config file
-    await this.configureIncludeIf(credentialsConfigPath)
+    await this.setExtraheaderConfig(extraheaderConfigValue)
   }
 
   async removeAuth(): Promise<void> {
-    // Remove old-style extraheader config if it exists
     await this.getAndUnset()
-
-    // Remove includeIf entries that point to git-credentials-*.config files
-    // and clean up the credentials config files
-    await this.removeIncludeIfCredentials()
   }
 
-  /**
-   * Gets or creates the path to the credentials config file in RUNNER_TEMP.
-   * @returns The absolute path to the credentials config file
-   */
-  private getCredentialsConfigPath(): string {
-    if (this.credentialsConfigPath) {
-      return this.credentialsConfigPath
-    }
-
-    const runnerTemp = process.env['RUNNER_TEMP'] || ''
-    if (!runnerTemp) {
-      throw new Error('RUNNER_TEMP is not defined')
-    }
-
-    // Create a unique filename for this action instance
-    const configFileName = `git-credentials-${uuid()}.config`
-    this.credentialsConfigPath = path.join(runnerTemp, configFileName)
-
-    core.debug(`Credentials config path: ${this.credentialsConfigPath}`)
-    return this.credentialsConfigPath
-  }
-
-  /**
-   * Configures includeIf entries in the local git config to reference the credentials file.
-   * Sets up entries for both host and container paths to support Docker container actions.
-   */
-  private async configureIncludeIf(
-    credentialsConfigPath: string
-  ): Promise<void> {
-    // Host git directory
-    const gitDir = await this.git.getGitDirectory()
-    let hostGitDir = path.join(this.workingDirectory, gitDir)
-    hostGitDir = hostGitDir.replace(/\\/g, '/') // Use forward slashes, even on Windows
-
-    // Configure host includeIf
-    const hostIncludeKey = `includeIf.gitdir:${hostGitDir}.path`
-    await this.git.config(hostIncludeKey, credentialsConfigPath)
-
-    // Configure host includeIf for worktrees
-    const hostWorktreeIncludeKey = `includeIf.gitdir:${hostGitDir}/worktrees/*.path`
-    await this.git.config(hostWorktreeIncludeKey, credentialsConfigPath)
-
-    // Container paths for Docker container actions
-    const githubWorkspace = process.env['GITHUB_WORKSPACE']
-    if (githubWorkspace) {
-      let relativePath = path.relative(githubWorkspace, this.workingDirectory)
-      relativePath = relativePath.replace(/\\/g, '/') // Use forward slashes, even on Windows
-      const containerGitDir = path.posix.join(
-        '/github/workspace',
-        relativePath,
-        '.git'
-      )
-
-      // Container credentials config path
-      const containerCredentialsPath = path.posix.join(
-        '/github/runner_temp',
-        path.basename(credentialsConfigPath)
-      )
-
-      // Configure container includeIf
-      const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`
-      await this.git.config(containerIncludeKey, containerCredentialsPath)
-
-      // Configure container includeIf for worktrees
-      const containerWorktreeIncludeKey = `includeIf.gitdir:${containerGitDir}/worktrees/*.path`
-      await this.git.config(
-        containerWorktreeIncludeKey,
-        containerCredentialsPath
-      )
-    }
-  }
-
-  /**
-   * Removes the includeIf entry and credentials config file created by this action instance.
-   * Only cleans up the specific credentials file tracked in this.credentialsConfigPath,
-   * leaving credentials created by other actions (e.g., actions/checkout) intact.
-   */
-  private async removeIncludeIfCredentials(): Promise<void> {
-    // Only clean up if this action instance created a credentials config file
-    if (!this.credentialsConfigPath) {
-      return
-    }
-
-    try {
-      // Get all includeIf.gitdir keys from local config
-      const keys = await this.git.tryGetConfigKeys('^includeIf\\.gitdir:')
-
-      for (const key of keys) {
-        // Get all values for this key
-        const values = await this.git.tryGetConfigValues(key)
-        for (const value of values) {
-          // Only remove entries pointing to our specific credentials file
-          if (value === this.credentialsConfigPath) {
-            await this.git.tryConfigUnsetValue(key, value)
-            core.debug(`Removed includeIf entry: ${key} = ${value}`)
-          }
-        }
-      }
-    } catch (e) {
-      // Ignore errors during cleanup
-      core.debug(`Error during includeIf cleanup: ${utils.getErrorMessage(e)}`)
-    }
-
-    // Delete only our credentials config file
-    const runnerTemp = process.env['RUNNER_TEMP']
-    const resolvedCredentialsPath = path.resolve(this.credentialsConfigPath)
-    const resolvedRunnerTemp = runnerTemp ? path.resolve(runnerTemp) : ''
-    if (
-      resolvedRunnerTemp &&
-      resolvedCredentialsPath.startsWith(resolvedRunnerTemp + path.sep)
-    ) {
-      try {
-        await fs.promises.unlink(this.credentialsConfigPath)
-        core.info(
-          `Removed credentials config file: ${this.credentialsConfigPath}`
-        )
-      } catch (e) {
-        core.debug(
-          `Could not remove credentials file ${this.credentialsConfigPath}: ${utils.getErrorMessage(e)}`
-        )
-      }
-    }
-  }
-
-  /**
-   * Sets extraheader config directly in .git/config (old-style auth).
-   * Used only for restoring persisted credentials from checkout@v4/v5.
-   */
   private async setExtraheaderConfig(
     extraheaderConfigValue: string
   ): Promise<void> {
     // Configure a placeholder value. This approach avoids the credential being captured
     // by process creation audit events, which are commonly logged. For more information,
     // refer to https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
+    // See https://github.com/actions/checkout/blob/main/src/git-auth-helper.ts#L267-L274
     await this.git.config(
       this.extraheaderConfigKey,
       this.extraheaderConfigPlaceholderValue
     )
-    // Replace the placeholder in the local git config
-    const gitDir = await this.git.getGitDirectory()
-    const gitConfigPath = path.join(this.workingDirectory, gitDir, 'config')
-    let content = (await fs.promises.readFile(gitConfigPath)).toString()
-    const index = content.indexOf(this.extraheaderConfigPlaceholderValue)
-    if (
-      index < 0 ||
-      index != content.lastIndexOf(this.extraheaderConfigPlaceholderValue)
-    ) {
-      throw new Error(
-        `Unable to replace '${this.extraheaderConfigPlaceholderValue}' in ${gitConfigPath}`
-      )
-    }
-    content = content.replace(
+    // Replace the placeholder
+    await this.gitConfigStringReplace(
       this.extraheaderConfigPlaceholderValue,
       extraheaderConfigValue
     )
-    await fs.promises.writeFile(gitConfigPath, content)
+  }
+
+  private async hideCredentialFiles(): Promise<void> {
+    // Temporarily hide checkout@v6 credential files to avoid duplicate auth headers
+    const runnerTemp = process.env['RUNNER_TEMP']
+    if (!runnerTemp) {
+      return
+    }
+
+    try {
+      const files = await fs.promises.readdir(runnerTemp)
+      for (const file of files) {
+        if (file.startsWith('git-credentials-') && file.endsWith('.config')) {
+          const sourcePath = path.join(runnerTemp, file)
+          const backupPath = `${sourcePath}.bak`
+          await fs.promises.rename(sourcePath, backupPath)
+          this.backedUpCredentialFiles.push(backupPath)
+          core.info(
+            `Temporarily hiding checkout credential file: ${file} (will be restored after)`
+          )
+        }
+      }
+    } catch (e) {
+      // If directory doesn't exist or we can't read it, just continue
+      core.debug(
+        `Could not backup credential files: ${utils.getErrorMessage(e)}`
+      )
+    }
+  }
+
+  private async unhideCredentialFiles(): Promise<void> {
+    // Restore checkout@v6 credential files that were backed up
+    for (const backupPath of this.backedUpCredentialFiles) {
+      try {
+        const originalPath = backupPath.replace(/\.bak$/, '')
+        await fs.promises.rename(backupPath, originalPath)
+        const fileName = path.basename(originalPath)
+        core.info(`Restored checkout credential file: ${fileName}`)
+      } catch (e) {
+        core.warning(
+          `Failed to restore credential file ${backupPath}: ${utils.getErrorMessage(e)}`
+        )
+      }
+    }
+    this.backedUpCredentialFiles = []
   }
 
   private async getAndUnset(): Promise<string> {
@@ -384,4 +247,21 @@ export class GitConfigHelper {
     }
     return configValue
   }
+
+  private async gitConfigStringReplace(
+    find: string,
+    replace: string
+  ): Promise<void> {
+    if (this.gitConfigPath.length === 0) {
+      const gitDir = await this.git.getGitDirectory()
+      this.gitConfigPath = path.join(this.workingDirectory, gitDir, 'config')
+    }
+    let content = (await fs.promises.readFile(this.gitConfigPath)).toString()
+    const index = content.indexOf(find)
+    if (index < 0 || index != content.lastIndexOf(find)) {
+      throw new Error(`Unable to replace '${find}' in ${this.gitConfigPath}`)
+    }
+    content = content.replace(find, replace)
+    await fs.promises.writeFile(this.gitConfigPath, content)
+  }
 }

src/github-helper.ts

@@ -1,4 +1,5 @@
 import * as core from '@actions/core'
+import {RequestError} from '@octokit/request-error'
 import {Inputs} from './create-pull-request'
 import {Commit, GitCommandManager} from './git-command-manager'
 import {
@@ -209,32 +210,51 @@ export class GitHubHelper {
       headRepository
     )
 
+    // After creating a new PR, follow-up API calls can fail with a 422
+    // "Could not resolve to a node" error due to GitHub API eventual
+    // consistency. Wrap post-creation calls with targeted retry logic.
+    // See: https://github.com/peter-evans/create-pull-request/issues/4321
+    const isEventualConsistencyError = (e: unknown): boolean =>
+      e instanceof RequestError &&
+      e.status === 422 &&
+      e.message.includes('Could not resolve to a node')
+    const withRetryForNewPr = <T>(fn: () => Promise<T>): Promise<T> =>
+      pull.created
+        ? utils.retryWithBackoff(fn, isEventualConsistencyError)
+        : fn()
+
     // Apply milestone
     if (inputs.milestone) {
       core.info(`Applying milestone '${inputs.milestone}'`)
-      await this.octokit.rest.issues.update({
-        ...this.parseRepository(baseRepository),
-        issue_number: pull.number,
-        milestone: inputs.milestone
-      })
+      await withRetryForNewPr(() =>
+        this.octokit.rest.issues.update({
+          ...this.parseRepository(baseRepository),
+          issue_number: pull.number,
+          milestone: inputs.milestone
+        })
+      )
     }
     // Apply labels
     if (inputs.labels.length > 0) {
       core.info(`Applying labels '${inputs.labels}'`)
-      await this.octokit.rest.issues.addLabels({
-        ...this.parseRepository(baseRepository),
-        issue_number: pull.number,
-        labels: inputs.labels
-      })
+      await withRetryForNewPr(() =>
+        this.octokit.rest.issues.addLabels({
+          ...this.parseRepository(baseRepository),
+          issue_number: pull.number,
+          labels: inputs.labels
+        })
+      )
     }
     // Apply assignees
     if (inputs.assignees.length > 0) {
       core.info(`Applying assignees '${inputs.assignees}'`)
-      await this.octokit.rest.issues.addAssignees({
-        ...this.parseRepository(baseRepository),
-        issue_number: pull.number,
-        assignees: inputs.assignees
-      })
+      await withRetryForNewPr(() =>
+        this.octokit.rest.issues.addAssignees({
+          ...this.parseRepository(baseRepository),
+          issue_number: pull.number,
+          assignees: inputs.assignees
+        })
+      )
     }
 
     // Request reviewers and team reviewers
@@ -250,11 +270,13 @@ export class GitHubHelper {
     }
     if (Object.keys(requestReviewersParams).length > 0) {
       try {
-        await this.octokit.rest.pulls.requestReviewers({
-          ...this.parseRepository(baseRepository),
-          pull_number: pull.number,
-          ...requestReviewersParams
-        })
+        await withRetryForNewPr(() =>
+          this.octokit.rest.pulls.requestReviewers({
+            ...this.parseRepository(baseRepository),
+            pull_number: pull.number,
+            ...requestReviewersParams
+          })
+        )
       } catch (e) {
         if (utils.getErrorMessage(e).includes(ERROR_PR_REVIEW_TOKEN_SCOPE)) {
           core.error(

src/utils.ts

@@ -140,3 +140,27 @@ export const isSelfHosted = (): boolean =>
   process.env['RUNNER_ENVIRONMENT'] !== 'github-hosted' &&
   (process.env['AGENT_ISSELFHOSTED'] === '1' ||
     process.env['AGENT_ISSELFHOSTED'] === undefined)
+
+export async function retryWithBackoff<T>(
+  fn: () => Promise<T>,
+  shouldRetry: (error: unknown) => boolean,
+  maxRetries = 2,
+  delayMs = 1000
+): Promise<T> {
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      return await fn()
+    } catch (e) {
+      if (attempt < maxRetries && shouldRetry(e)) {
+        const delay = delayMs * Math.pow(2, attempt)
+        core.info(
+          `Request failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${delay}ms...`
+        )
+        await new Promise(resolve => setTimeout(resolve, delay))
+      } else {
+        throw e
+      }
+    }
+  }
+  throw new Error('Unexpected: retry loop exited without return or throw')
+}