From 7b51871e8f69e4a72ac27d9290485f340d5fa2b8 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 5 Jun 2026 04:07:12 +0000
Subject: [PATCH] ci: authenticate git push in daily branch workflows

Since persist-credentials: false was added by the zizmor security fix,
the daily branch creation workflows could not authenticate the git push
step and failed with "could not read Username for 'https://github.com'".
This pushes via the GITHUB_TOKEN-embedded HTTPS URL so the credential
stays scoped to the single push command instead of being persisted in
the runner's git config.

Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>
---
 .../create_daily_oss_agent_shin_branch.yml     |  9 ++-------
 .../workflows/create_daily_staging_branch.yml  | 18 ++++--------------
 2 files changed, 6 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/create_daily_oss_agent_shin_branch.yml b/.github/workflows/create_daily_oss_agent_shin_branch.yml
index d6118f3b53c..dc63fa1f65d 100644
--- a/.github/workflows/create_daily_oss_agent_shin_branch.yml
+++ b/.github/workflows/create_daily_oss_agent_shin_branch.yml
@@ -22,26 +22,21 @@ jobs:
       - name: Create daily oss-agent-shin branch
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
         run: |
-          # Configure Git user
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-          # Generate branch name with MM_DD_YYYY format
           BRANCH_NAME="litellm_oss_agent_shin_$(date +'%m_%d_%Y')"
           echo "Creating branch: $BRANCH_NAME"
 
-          # Fetch all branches
           git fetch --all
 
-          # Check if the branch already exists
           if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
             echo "Branch $BRANCH_NAME already exists. Skipping creation."
           else
             echo "Creating new branch: $BRANCH_NAME"
-            # Create the new branch from main
             git checkout -b $BRANCH_NAME origin/main
-            # Push the new branch
-            git push origin $BRANCH_NAME
+            git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" $BRANCH_NAME
             echo "Successfully created and pushed branch: $BRANCH_NAME"
           fi
diff --git a/.github/workflows/create_daily_staging_branch.yml b/.github/workflows/create_daily_staging_branch.yml
index 424d8de0a41..18be191910f 100644
--- a/.github/workflows/create_daily_staging_branch.yml
+++ b/.github/workflows/create_daily_staging_branch.yml
@@ -22,27 +22,22 @@ jobs:
       - name: Create daily staging branch
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
         run: |
-          # Configure Git user
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-          # Generate branch name with MM_DD_YYYY format
           BRANCH_NAME="litellm_oss_staging_$(date +'%m_%d_%Y')"
           echo "Creating branch: $BRANCH_NAME"
 
-          # Fetch all branches
           git fetch --all
 
-          # Check if the branch already exists
           if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
             echo "Branch $BRANCH_NAME already exists. Skipping creation."
           else
             echo "Creating new branch: $BRANCH_NAME"
-            # Create the new branch from main
             git checkout -b $BRANCH_NAME origin/main
-            # Push the new branch
-            git push origin $BRANCH_NAME
+            git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" $BRANCH_NAME
             echo "Successfully created and pushed branch: $BRANCH_NAME"
           fi
 
@@ -62,26 +57,21 @@ jobs:
       - name: Create internal dev branch
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
         run: |
-          # Configure Git user
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-          # Generate branch name with MM_DD_YYYY format
           BRANCH_NAME="litellm_internal_dev_$(date +'%m_%d_%Y')"
           echo "Creating branch: $BRANCH_NAME"
 
-          # Fetch all branches
           git fetch --all
 
-          # Check if the branch already exists
           if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
             echo "Branch $BRANCH_NAME already exists. Skipping creation."
           else
             echo "Creating new branch: $BRANCH_NAME"
-            # Create the new branch from main
             git checkout -b $BRANCH_NAME origin/main
-            # Push the new branch
-            git push origin $BRANCH_NAME
+            git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" $BRANCH_NAME
             echo "Successfully created and pushed branch: $BRANCH_NAME"
           fi