Today I learned that the GitHub Checkout actions sets the http.[..].extraheader config flag which silently applies to all git commands and prevents the use of any other tokens. Even with all my effort to isolate the CI tasks from the runner environment, this one config leaked through...