.

src/git-auth-helper.ts

@@ -473,14 +473,21 @@ class GitAuthHelper {
 
     // Remove credentials config files
     for (const credentialsPath of credentialsPaths) {
-      try {
-        core.info(`Removing credentials config '${credentialsPath}'`)
-        await io.rmRF(credentialsPath)
-      } catch (err) {
-        core.debug(`${(err as any)?.message ?? err}`)
-        core.warning(
-          `Failed to remove credentials config '${credentialsPath}'`
-        )
+      // Only remove credentials config files if they are under RUNNER_TEMP
+      const runnerTemp = process.env['RUNNER_TEMP']
+      assert.ok(runnerTemp, 'RUNNER_TEMP is not defined')
+      if (credentialsPath.startsWith(runnerTemp)) {
+        try {
+          core.info(`Removing credentials config '${credentialsPath}'`)
+          await io.rmRF(credentialsPath)
+        } catch (err) {
+          core.debug(`${(err as any)?.message ?? err}`)
+          core.warning(
+            `Failed to remove credentials config '${credentialsPath}'`
+          )
+        }
+      } else {
+        core.debug(`Skipping removal of credentials config '${credentialsPath}' - not under RUNNER_TEMP`)
       }
     }
   }