Revoked app token is left in the origin remote URL, breaking later git operations in the same job

[AlexanderBartash]

Summary

When no github_token input is provided, the action mints a GitHub App installation token, configureGitAuth embeds it in the origin remote URL (src/github/operations/git-config.ts), and the composite's final step revokes that token ("Revoke app token" in action.yml). The origin URL is never restored, so after the action completes, origin still points to https://x-access-token:<revoked-token>@github.com/<owner>/<repo>.git.

Any later step in the same job that contacts origin then fails — including a second invocation of this action itself, whose tag-mode setupBranch runs git fetch origin before configuring its own auth (#1236).

Reproduction

steps:
  - uses: actions/checkout@v6
    with:
      persist-credentials: false

  # First invocation (agent mode) - completes fine, revokes its token on exit
  - uses: anthropics/claude-code-action@v1
    with:
      claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      prompt: "Summarize the repository layout."

  # Any later git operation against origin fails
  - run: git fetch origin main

In our case the failing step was a second invocation of the action (tag mode). Its setupBranch fetch used the revoked token left in the origin URL:

This is an open PR, checking out PR branch...
remote: Invalid username or token. Password authentication is not supported for Git operations.
Error: Action failed with error: Command failed: git fetch origin --depth=20 <branch>

Note: with the default persist-credentials: true and actions/checkout >= v6 (or v5.0.1 / v4.3.1), the failure can be masked, because the credential persisted by checkout is stored in a separate config file that survives configureGitAuth's cleanup and still authenticates the fetch despite the revoked token in the URL. I will file that cleanup defect separately.

Expected behaviour

The cleanup that revokes the token should also restore a credential-free origin URL, e.g.:

git remote set-url origin "https://github.com/<owner>/<repo>.git"

leaving the workspace usable for later steps, the same way actions/checkout cleans up after itself.

Version

Observed on v1.0.169; the relevant code is unchanged on current main.