Summary

Adds persist-credentials: false to all actions/checkout@v6 steps in workflow templates to prevent the "Duplicate Authorization header" error.

Problem

When using actions/checkout@v6 with the OpenCode GitHub action, users encounter:

remote: Duplicate header: "Authorization"
fatal: unable to access 'https://github.com/...': The requested URL returned error: 400

Root Cause

1. actions/checkout@v6 persists the GitHub token to git config via http.extraheader
2. The anomalyco/opencode/github@latest action adds its own authentication
3. Both Authorization headers get sent to GitHub → 400 error

Solution

Add persist-credentials: false to the checkout step in all workflow templates:

- uses: actions/checkout@v6
  with:
    persist-credentials: false

This prevents the checkout action from persisting credentials, allowing the OpenCode action to handle authentication without conflicts.

Changes

• packages/opencode/src/cli/cmd/github.ts - CLI-generated workflow template
• packages/web/src/content/docs/github.mdx - Documentation examples (4 workflows)
• github/README.md - Manual setup example

Related Issues

• Fixes Github plugin having duplicate Authorization header (problem with private repos?) #7325 - "Github plugin having duplicate Authorization header"
• Related to GitHub action incompatible with actions/checkout@v6 #5827 - "GitHub action incompatible with actions/checkout@v6" (closed, different fix approach)
• Builds on docs: update GHA examples to use actions/checkout@v6 #6969 - "docs: update GHA examples to use actions/checkout@v6" (merged, but didn't add persist-credentials)

Testing

Users experiencing the error can update their workflows to include persist-credentials: false in the checkout step. New users following the setup instructions will get the correct configuration automatically.