Fix checkout step in GH release action

Author: fkleedorfer

.github/workflows/release-and-deploy.yml

@@ -3,11 +3,13 @@
 # releases the project with specified version
 # deploys it to the sonatype staging repo
 name: Release and deploy to Sonatype staging repo
+
 env:
   GITHUB_PAT: ${{ secrets.QUDTLIB_BOT_GITHUB_TOKEN }}
   MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
   MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
   MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+
 on:
   workflow_dispatch:
     inputs:
@@ -19,15 +21,6 @@ on:
         description: 'Next SNAPSHOT version (such as 2.4-SNAPSHOT)'
         required: true
         type: string
-    secrets:
-      QUDTLIB_BOT_GITHUB_TOKEN:
-        required: true
-      MAVEN_USERNAME:
-        required: true
-      MAVEN_CENTRAL_TOKEN:
-        required: true
-      MAVEN_GPG_PASSPHRASE:
-        required: true
 
 jobs:
   build:
@@ -37,6 +30,25 @@ jobs:
       pull-requests: write
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.QUDTLIB_BOT_GITHUB_TOKEN }}
+          fetch-depth: 0
+          persist-credentials: true
+
+      # Critical fix for "could not read Username" and duplicate header issues
+      - name: Configure Git credentials (insteadOf)
+        run: |
+          git config --global url."https://${{ secrets.QUDTLIB_BOT_GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
+
+      # Extra safety - remove any conflicting extraheader
+      - name: Fix git authentication headers
+        run: |
+          git config --global --unset http.https://github.com/.extraheader || true
+          git config --local --unset http.https://github.com/.extraheader || true
+
+      # Check write access to repo
       - name: Check write access to repo
         run: |
           token_login=$(curl -H "Authorization: Bearer ${token}" https://api.github.com/user | jq -r '.login')
@@ -57,26 +69,14 @@ jobs:
           tag: v${{ inputs.release_version }}
         env:
           GITHUB_TOKEN: ${{ secrets.QUDTLIB_BOT_GITHUB_TOKEN }}
+
       - name: Fail if tag v${{ inputs.release_version }} exists
         if: steps.checkTag.outputs.exists == 'true'
         run: |
           echo Tag v${{ inputs.release_version }} already exists, release aborted >> $GITHUB_STEP_SUMMARY
           exit 1
 
-
-
-      # Set up java with maven cache
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          token: ${{ secrets.QUDTLIB_BOT_GITHUB_TOKEN }}
-          fetch-depth: 0
-
-      - name: Fix git authentication headers
-        run: |
-          git config --global --unset http.https://github.com/.extraheader || true
-          git config --local --unset http.https://github.com/.extraheader || true
-
+      # Set up Java + Maven
       - name: Set up JDK 21
         uses: actions/setup-java@v5
         with:
@@ -182,8 +182,8 @@ jobs:
             # Next Steps
             
             Please rebase this PR on top of `main` after publishing the release via the 
-            [Sonatype Repository Manager](https://central.sonatype.com/publishing/deployments). 
+            [Sonatype Repository Manager](https://central.sonatype.com/publishing/deployments).
 
       # print the summary
       - name: Print summary
-        run: echo "Release ${{ inputs.release_version }} deployed to sonatype staging repo. Please go there, close the repo and publish it." >> $GITHUB_STEP_SUMMARY
+        run: echo "Release ${{ inputs.release_version }} deployed to sonatype staging repo. Please go there, close the repo and publish it." >> $GITHUB_STEP_SUMMARY