Credential config for `git.heroku.com` should reset inherited helpers
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- git, typescript
- Domain
- authentication, cli
Research direction
Start by locating the CLI code that writes the credential configuration for git.heroku.com, then review how it emits the heroku git:credentials helper. Reproduce the behavior with a global helper and a stale credential, and verify that the generated configuration resets inherited helpers before the CLI helper and that git push heroku uses the CLI credential.
Written by the indexing model from the issue text.
Description
The CLI configures a credential helper for git.heroku.com as:
[credential "https://git.heroku.com"]
helper = !heroku git:credentials
Git treats credential.helper as an additive list, so this appended helper doesn't replace a globally-configured helper — it runs after it.
For users with a global helper such as Git Credential Manager (GCM):
[credential]
helper =
helper = /usr/local/share/gcm-core/git-credential-manager
...GCM is consulted first for git.heroku.com which:
- Causes unnecessary extra work.
- Could return a stale cached credential, shadowing
heroku git:credentialsand causinggit push herokuto fail authentication.
Adding a blank helper = reset before the CLI's helper scopes the host to the CLI's helper only. A blank value clears helpers inherited so far for this URL context; other URLs are unaffected:
[credential "https://git.heroku.com"]
helper =
helper = !heroku git:credentials
This mirrors how a global [credential] block commonly resets the list before setting its preferred helper. (And is what GCM does in its own config block.)
Reproduction
- Set a global credential helper, e.g.
git config --global credential.helper manager(GCM). - Let the CLI write its
git.heroku.comcredential config. - With a stale/incorrect credential cached in GCM for
git.heroku.com, rungit push heroku— GCM's credential is used instead ofheroku git:credentials, and auth fails.
$ heroku --version
heroku/11.9.0 darwin-arm64 node-v22.23.2
$ which heroku
/opt/homebrew/bin/heroku
- Dominant language
- TypeScript
- Stars
- 889
- Forks
- 236
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 34
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from heroku/cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Difficulty 3/5 1-2 days Newbie friendliness 62/100
-
on-call reviewed
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
-
on-call reviewed
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100