heroku / heroku/cli

Credential config for `git.heroku.com` should reset inherited helpers

Open Beginner friendly
#3,867 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
889
Forks
236
Avg merge
2d 10h
Merged PRs (30d)
33

Description

The CLI configures a credential helper for `git.heroku.com` as:

```
[credential "https://git.heroku.com"]
helper = !heroku git:credentials
```

Git treats `credential.helper` as an *additive list*, so this appended helper doesn't replace a globally-configured helper — it runs *after* it.

For users with a global helper such as Git Credential Manager (GCM):

```
[credential]
helper =
helper = /usr/local/share/gcm-core/git-credential-manager
```

...GCM is consulted first for `git.heroku.com` which:
1. Causes unnecessary extra work.
2. Could return a stale cached credential, shadowing `heroku git:credentials` and causing `git push heroku` to fail authentication.

Adding a blank `helper =` reset before the CLI's helper scopes the host to the CLI's helper only. A blank value clears helpers inherited so far for this URL context; other URLs are unaffected:

```
[credential "https://git.heroku.com"]
helper =
helper = !heroku git:credentials
```

This mirrors how a global `[credential]` block commonly resets the list before setting its preferred helper. (And is what GCM does in its own config block.)

**Reproduction**
1. Set a global credential helper, e.g. `git config --global credential.helper manager` (GCM).
2. Let the CLI write its `git.heroku.com` credential config.
3. With a stale/incorrect credential cached in GCM for `git.heroku.com`, run `git push heroku` — GCM's credential is used instead of `heroku git:credentials`, and auth fails.

```
$ heroku --version
heroku/11.9.0 darwin-arm64 node-v22.23.2
$ which heroku
/opt/homebrew/bin/heroku
```

Contributor guide

Open the contributing guide

Research direction

Start by locating the CLI code that writes the credential configuration for git.heroku.com, then review how it emits the heroku git:credentials helper. Reproduce the behavior with a global helper and a stale credential, and verify that the generated configuration resets inherited helpers before the CLI helper and that git push heroku uses the CLI credential.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, typescript
Domain
authentication, cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.