Problem
go get / go mod download triggers Git’s HTTP challenge-response: an unauthenticated request → 401 → retry with credentials. At scale, the 401s trigger GitHub’s anti-abuse system and block CI runner NAT IPs.
Fix: proactiveAuth
git config http.https://github.com/your-org/.proactiveAuth auto tells Git to send credentials on the first request, skipping the 401.
Why a credential helper is needed
actions/checkout authenticates via .extraheader (an AUTHORIZATION header injected into git config), not via Git’s credential helper. proactiveAuth only triggers the credential helper path. Without a credential helper configured, git fetch after checkout fails with could not read Username.
The wrapper sets up a global credential helper using the same token:
git config --global credential.https://github.com.helper \
'!f() { echo "username=x-access-token"; echo "password=${TOKEN}"; }; f'Why proactiveAuth must be disabled during checkout
actions/checkout injects its own auth headers via .extraheader. If proactiveAuth is also enabled, Git sends credentials via both the credential helper AND the extraheader simultaneously, which conflicts and breaks checkout. The wrapper disables proactiveAuth before checkout and re-enables it after.
persist-credentials interaction
true(default): credentials stay in local git config after checkout. The wrapper sets up the credential helper and enables proactiveAuth.false: user explicitly opts out of persisted credentials. The wrapper skips credential helper setup to respect that intent. proactiveAuth is also skipped since it would fail without credentials.
Git version string bug
The runner Dockerfile sets ENV GIT_VERSION=v2.53.0. Git’s GIT-VERSION-GEN script checks if test -z "$GIT_VERSION" — since the env var is already set, it skips version detection (including v prefix stripping) and uses v2.53.0 as-is. This produces git version v2.53.0 instead of git version 2.53.0. Go’s version parser regex (git version\s+(\d+\.\d+(?:\.\d+)?)) expects digits after git version and fails on the v. Fix: pass GIT_VERSION=${GIT_VERSION#v} to make.