From a60fb6cabeb5b7d5054ef3e79ff58ab31a034001 Mon Sep 17 00:00:00 2001
From: eric sciple <ericsciple@users.noreply.github.com>
Date: Tue, 14 Oct 2025 22:24:46 +0000
Subject: [PATCH] Use git config --show-origin to reliably get submodule config
 paths

---
 dist/index.js          | 16 ++++++++++------
 src/git-auth-helper.ts | 20 +++++++++++++-------
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/dist/index.js b/dist/index.js
index dddd213..36fb2d2 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -280,23 +280,27 @@ class GitAuthHelper {
                 let relativePath = path.relative(githubWorkspace, workingDirectory);
                 relativePath = relativePath.replace(/\\/g, '/');
                 const containerWorkspaceBase = path.posix.join('/github/workspace', relativePath);
-                // Get submodule paths.
-                // `git rev-parse --show-toplevel` returns the absolute path of each submodule's working tree.
-                const submodulePaths = yield this.git.submoduleForeach(`git rev-parse --show-toplevel`, this.settings.nestedSubmodules);
+                // Get submodule config file paths.
+                // Use `--show-origin` to get the config file path for each submodule.
+                const output = yield this.git.submoduleForeach(`git config --local --show-origin --name-only --get-regexp remote.origin.url`, this.settings.nestedSubmodules);
+                // Extract config file paths from the output (lines starting with "file:").
+                const configPaths = output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || [];
                 // For each submodule, configure includeIf entries pointing to the shared credentials file.
                 // Configure both host and container paths to support Docker container actions.
-                for (const submodulePath of submodulePaths.split('\n').filter(x => x)) {
+                for (const configPath of configPaths) {
+                    // Get the submodule path from its config file path.
+                    const submodulePath = path.dirname(path.dirname(configPath));
                     // Configure host path includeIf.
                     // Use forward slashes for git config, even on Windows.
                     let submoduleGitDir = path.join(submodulePath, '.git');
                     submoduleGitDir = submoduleGitDir.replace(/\\/g, '/');
-                    yield this.git.config(`includeIf.gitdir:${submoduleGitDir}.path`, credentialsConfigPath, false, false, path.join(submodulePath, '.git', 'config'));
+                    yield this.git.config(`includeIf.gitdir:${submoduleGitDir}.path`, credentialsConfigPath, false, false, configPath);
                     // Configure container path includeIf.
                     // Use forward slashes for git config, even on Windows.
                     let submoduleRelativePath = path.relative(workingDirectory, submodulePath);
                     submoduleRelativePath = submoduleRelativePath.replace(/\\/g, '/');
                     const containerSubmoduleGitDir = path.posix.join(containerWorkspaceBase, submoduleRelativePath, '.git');
-                    yield this.git.config(`includeIf.gitdir:${containerSubmoduleGitDir}.path`, containerCredentialsPath, false, false, path.join(submodulePath, '.git', 'config'));
+                    yield this.git.config(`includeIf.gitdir:${containerSubmoduleGitDir}.path`, containerCredentialsPath, false, false, configPath);
                 }
                 if (this.settings.sshKey) {
                     // Configure core.sshCommand
diff --git a/src/git-auth-helper.ts b/src/git-auth-helper.ts
index b7ac196..4abc64e 100644
--- a/src/git-auth-helper.ts
+++ b/src/git-auth-helper.ts
@@ -190,16 +190,22 @@ class GitAuthHelper {
         relativePath
       )
 
-      // Get submodule paths.
-      // `git rev-parse --show-toplevel` returns the absolute path of each submodule's working tree.
-      const submodulePaths = await this.git.submoduleForeach(
-        `git rev-parse --show-toplevel`,
+      // Get submodule config file paths.
+      // Use `--show-origin` to get the config file path for each submodule.
+      const output = await this.git.submoduleForeach(
+        `git config --local --show-origin --name-only --get-regexp remote.origin.url`,
         this.settings.nestedSubmodules
       )
 
+      // Extract config file paths from the output (lines starting with "file:").
+      const configPaths =
+        output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || []
+
       // For each submodule, configure includeIf entries pointing to the shared credentials file.
       // Configure both host and container paths to support Docker container actions.
-      for (const submodulePath of submodulePaths.split('\n').filter(x => x)) {
+      for (const configPath of configPaths) {
+        // Get the submodule path from its config file path.
+        const submodulePath = path.dirname(path.dirname(configPath))
         // Configure host path includeIf.
         // Use forward slashes for git config, even on Windows.
         let submoduleGitDir = path.join(submodulePath, '.git')
@@ -209,7 +215,7 @@ class GitAuthHelper {
           credentialsConfigPath,
           false,
           false,
-          path.join(submodulePath, '.git', 'config')
+          configPath
         )
 
         // Configure container path includeIf.
@@ -229,7 +235,7 @@ class GitAuthHelper {
           containerCredentialsPath,
           false,
           false,
-          path.join(submodulePath, '.git', 'config')
+          configPath
         )
       }