no persist credentials

Author: charleslien

.github/workflows/mirror-dot-agents.yml

@@ -1,4 +1,4 @@
-name: Mirror subdir to .agents
+name: Mirror subdir to dot-agents
 on:
   push:
     branches: [main]
@@ -12,10 +12,17 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
+
+      # (belt-and-suspenders) ensure the injected header is gone even if persist-credentials isn't honored
+      - name: Clear default GitHub auth header
+        run: git config --global --unset-all http.https://github.com/.extraheader || true
+
       - name: Configure Git
         run: |
-          git config user.name "github-actions[bot]"
+          git config user.name "codebuff mirror bot"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
       - name: Push subtree
         env:
           TOKEN: ${{ secrets.CODEBUFF_GITHUB_TOKEN }}