From 1929737c8ebde1680feb5786e41f0fdfc2f4ff52 Mon Sep 17 00:00:00 2001
From: eric sciple <ericsciple@users.noreply.github.com>
Date: Fri, 17 Oct 2025 00:32:56 +0000
Subject: [PATCH] .

---
 dist/index.js          | 20 ++++++++++++++------
 src/git-auth-helper.ts | 23 +++++++++++++++--------
 2 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/dist/index.js b/dist/index.js
index 00553d6..bdd7187 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -498,13 +498,21 @@ class GitAuthHelper {
             }
             // Remove credentials config files
             for (const credentialsPath of credentialsPaths) {
-                try {
-                    core.info(`Removing credentials config '${credentialsPath}'`);
-                    yield io.rmRF(credentialsPath);
+                // Only remove credentials config files if they are under RUNNER_TEMP
+                const runnerTemp = process.env['RUNNER_TEMP'];
+                assert.ok(runnerTemp, 'RUNNER_TEMP is not defined');
+                if (credentialsPath.startsWith(runnerTemp)) {
+                    try {
+                        core.info(`Removing credentials config '${credentialsPath}'`);
+                        yield io.rmRF(credentialsPath);
+                    }
+                    catch (err) {
+                        core.debug(`${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+                        core.warning(`Failed to remove credentials config '${credentialsPath}'`);
+                    }
                 }
-                catch (err) {
-                    core.debug(`${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
-                    core.warning(`Failed to remove credentials config '${credentialsPath}'`);
+                else {
+                    core.debug(`Skipping removal of credentials config '${credentialsPath}' - not under RUNNER_TEMP`);
                 }
             }
         });
diff --git a/src/git-auth-helper.ts b/src/git-auth-helper.ts
index 5a3d388..32510a8 100644
--- a/src/git-auth-helper.ts
+++ b/src/git-auth-helper.ts
@@ -473,14 +473,21 @@ class GitAuthHelper {
 
     // Remove credentials config files
     for (const credentialsPath of credentialsPaths) {
-      try {
-        core.info(`Removing credentials config '${credentialsPath}'`)
-        await io.rmRF(credentialsPath)
-      } catch (err) {
-        core.debug(`${(err as any)?.message ?? err}`)
-        core.warning(
-          `Failed to remove credentials config '${credentialsPath}'`
-        )
+      // Only remove credentials config files if they are under RUNNER_TEMP
+      const runnerTemp = process.env['RUNNER_TEMP']
+      assert.ok(runnerTemp, 'RUNNER_TEMP is not defined')
+      if (credentialsPath.startsWith(runnerTemp)) {
+        try {
+          core.info(`Removing credentials config '${credentialsPath}'`)
+          await io.rmRF(credentialsPath)
+        } catch (err) {
+          core.debug(`${(err as any)?.message ?? err}`)
+          core.warning(
+            `Failed to remove credentials config '${credentialsPath}'`
+          )
+        }
+      } else {
+        core.debug(`Skipping removal of credentials config '${credentialsPath}' - not under RUNNER_TEMP`)
       }
     }
   }