fix(ci): private repo auth, for real this time (#510)

.github/actions/setup-haxe/action.yml

@@ -71,14 +71,18 @@ runs:
       path: .haxelib
       key: haxe-hmm-${{ runner.os }}-${{ hashFiles('**/hmm.json') }}
 
+  - if: ${{ steps.cache-hmm.outputs.cache-hit != 'true' }}
+    name: Prep git for dependency install
+    uses: gacts/run-and-post-run@v1
+    with:
+      run: git config --global 'url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf' https://github.com/
+      post: git config --global --unset 'url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf'
+
   - if: ${{ steps.cache-hmm.outputs.cache-hit != 'true' }}
     name: Install dependencies
     shell: bash
     run: |
-      git config --global --unset 'url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf' || true
-      git config --global 'url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf' https://github.com/
       haxelib --global run hmm install -q
-      git config --global --unset 'url.https://x-access-token:${{ inputs.gh-token }}@github.com/.insteadOf'
       echo "TIMER_DONE=$(date +%s)" >> "$GITHUB_ENV"
 
   # by default use a shared hxcpp cache

.github/workflows/build-game.yml

@@ -39,6 +39,7 @@ jobs:
       with:
         submodules: 'recursive'
         token: ${{ steps.app_token.outputs.token }}
+        persist-credentials: false
 
     - name: Setup build environment
       uses: ./.github/actions/setup-haxe

build/Dockerfile

@@ -71,8 +71,6 @@ RUN <<EOF
 cat <<EOC >> /etc/gitconfig
 [safe]
   directory = *
-[credential]
-  helper = cache
 EOC
 
 ssh-keyscan -t rsa,ecdsa,ed25519 github.com >> /etc/ssh/ssh_known_hosts