.

src/git-auth-helper.ts

@@ -448,11 +448,29 @@ class GitAuthHelper {
     await this.removeGitConfig(this.tokenConfigKey)
     await this.removeSubmoduleGitConfig(this.tokenConfigKey)
 
-    // Remove includeIf
-    for (const includeKey of this.credentialsIncludeKeys) {
-      await this.removeGitConfig(includeKey)
+    // Remove includeIf entries that point to git-credentials-*.config files
+    // This is more aggressive than tracking keys, but necessary since cleanup
+    // runs in a post-step where this.credentialsIncludeKeys is empty
+    try {
+      // Get all includeIf.gitdir keys
+      const keys = await this.git.tryGetConfigKeys('^includeIf\\.gitdir:')
+      
+      for (const key of keys) {
+        // Get all values for this key
+        const values = await this.git.tryGetConfigValues(key)
+        if (values.length > 0) {
+          // Remove only values that match git-credentials-<uuid>.config pattern
+          for (const value of values) {
+            if (/git-credentials-[0-9a-f-]+\.config$/i.test(value)) {
+              await this.git.tryConfigUnsetValue(key, value)
+            }
+          }
+        }
+      }
+    } catch (err) {
+      // Ignore errors - this is cleanup code
+      core.debug(`Error during includeIf cleanup: ${err}`)
     }
-    this.credentialsIncludeKeys = []
 
     // Remove submodule includeIf
     await this.git.submoduleForeach(

src/git-command-manager.ts

@@ -60,8 +60,11 @@ export interface IGitCommandManager {
   tagExists(pattern: string): Promise<boolean>
   tryClean(): Promise<boolean>
   tryConfigUnset(configKey: string, globalConfig?: boolean): Promise<boolean>
+  tryConfigUnsetValue(configKey: string, configValue: string, globalConfig?: boolean): Promise<boolean>
   tryDisableAutomaticGarbageCollection(): Promise<boolean>
   tryGetFetchUrl(): Promise<string>
+  tryGetConfigValues(configKey: string, globalConfig?: boolean): Promise<string[]>
+  tryGetConfigKeys(pattern: string, globalConfig?: boolean): Promise<string[]>
   tryReset(): Promise<boolean>
   version(): Promise<GitVersion>
 }
@@ -462,6 +465,24 @@ class GitCommandManager {
     return output.exitCode === 0
   }
 
+  async tryConfigUnsetValue(
+    configKey: string,
+    configValue: string,
+    globalConfig?: boolean
+  ): Promise<boolean> {
+    const output = await this.execGit(
+      [
+        'config',
+        globalConfig ? '--global' : '--local',
+        '--unset',
+        configKey,
+        configValue
+      ],
+      true
+    )
+    return output.exitCode === 0
+  }
+
   async tryDisableAutomaticGarbageCollection(): Promise<boolean> {
     const output = await this.execGit(
       ['config', '--local', 'gc.auto', '0'],
@@ -488,6 +509,49 @@ class GitCommandManager {
     return stdout
   }
 
+  async tryGetConfigValues(
+    configKey: string,
+    globalConfig?: boolean
+  ): Promise<string[]> {
+    const output = await this.execGit(
+      [
+        'config',
+        globalConfig ? '--global' : '--local',
+        '--get-all',
+        configKey
+      ],
+      true
+    )
+
+    if (output.exitCode !== 0) {
+      return []
+    }
+
+    return output.stdout.trim().split('\n').filter(value => value.trim())
+  }
+
+  async tryGetConfigKeys(
+    pattern: string,
+    globalConfig?: boolean
+  ): Promise<string[]> {
+    const output = await this.execGit(
+      [
+        'config',
+        globalConfig ? '--global' : '--local',
+        '--name-only',
+        '--get-regexp',
+        pattern
+      ],
+      true
+    )
+
+    if (output.exitCode !== 0) {
+      return []
+    }
+
+    return output.stdout.trim().split('\n').filter(key => key.trim())
+  }
+
   async tryReset(): Promise<boolean> {
     const output = await this.execGit(['reset', '--hard', 'HEAD'], true)
     return output.exitCode === 0