Add debug logging to pushWithToken for CI troubleshooting

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: theoephraim

packages/bumpy/src/commands/ci.ts

@@ -249,6 +249,7 @@ function pushWithToken(rootDir: string, branch: string, config: BumpyConfig): vo
     // Both must be cleared for our custom token to be used.
     const extraHeaderKey = `http.${server}/.extraheader`;
     const savedHeader = tryRunArgs(['git', 'config', '--local', extraHeaderKey], { cwd: rootDir });
+    log.dim(`  extraheader present: ${!!savedHeader}`);
 
     // Collect includeIf entries that point to credential config files
     // git config --get-regexp outputs keys in lowercase, so match accordingly
@@ -264,26 +265,96 @@ function pushWithToken(rootDir: string, branch: string, config: BumpyConfig): vo
         }
       }
     }
+    log.dim(`  includeIf entries found: ${savedIncludeIfs.length}`);
+    for (const entry of savedIncludeIfs) {
+      log.dim(`    ${entry.key}`);
+    }
+
+    // Dump full git config for debugging
+    const fullConfig = tryRunArgs(['git', 'config', '--local', '--list'], { cwd: rootDir });
+    if (fullConfig) {
+      for (const line of fullConfig.split('\n')) {
+        if (/includeif|extraheader/i.test(line)) {
+          log.dim(`  [git config] ${line}`);
+        }
+      }
+    }
 
     try {
       if (savedHeader) {
         runArgs(['git', 'config', '--local', '--unset-all', extraHeaderKey], { cwd: rootDir });
       }
       for (const entry of savedIncludeIfs) {
+        log.dim(`  Unsetting: ${entry.key}`);
         tryRunArgs(['git', 'config', '--local', '--unset', entry.key], { cwd: rootDir });
       }
+
+      // Verify cleanup
+      const remainingIncludeIf = tryRunArgs(['git', 'config', '--local', '--get-regexp', '^includeif\\.gitdir:'], {
+        cwd: rootDir,
+      });
+      if (remainingIncludeIf) {
+        log.warn(`  includeIf entries still present after cleanup:\n${remainingIncludeIf}`);
+      } else {
+        log.dim('  All includeIf entries cleared');
+      }
+
+      // Set both fetch and push URLs to the authed URL
       runArgs(['git', 'remote', 'set-url', 'origin', authedUrl], { cwd: rootDir });
+      runArgs(['git', 'remote', 'set-url', 'origin', authedUrl, '--push'], { cwd: rootDir });
+      // Verify URLs (redact token)
+      const verifyFetch = tryRunArgs(['git', 'remote', 'get-url', 'origin'], { cwd: rootDir });
+      const verifyPush = tryRunArgs(['git', 'remote', 'get-url', 'origin', '--push'], { cwd: rootDir });
+      log.dim(`  Fetch URL: ${verifyFetch?.replace(token, '***')}`);
+      log.dim(`  Push URL: ${verifyPush?.replace(token, '***')}`);
+
+      // Check for url.*.insteadOf rewrites (across all config levels)
+      const insteadOf = tryRunArgs(['git', 'config', '--get-regexp', '^url\\..*\\.insteadof'], { cwd: rootDir });
+      if (insteadOf) {
+        log.dim(`  url.*.insteadOf rules:\n${insteadOf}`);
+      }
+
+      // Dump the effective resolved push URL from git's perspective
+      const resolvedRemote = tryRunArgs(['git', 'ls-remote', '--get-url', 'origin'], { cwd: rootDir });
+      log.dim(`  Resolved remote: ${resolvedRemote?.replace(token, '***')}`);
+
+      // Check what credential helpers are active
+      const credHelper = tryRunArgs(['git', 'config', '--show-origin', '--get-all', 'credential.helper'], {
+        cwd: rootDir,
+      });
+      if (credHelper) {
+        log.dim(`  credential.helper:\n${credHelper}`);
+      }
+
+      // Test token validity via API before pushing
+      const origGhToken = process.env.GH_TOKEN;
+      process.env.GH_TOKEN = token;
+      const tokenCheck = tryRunArgs(
+        ['gh', 'api', 'repos/' + repo, '--jq', '.permissions'],
+        { cwd: rootDir },
+      );
+      log.dim(`  BUMPY_GH_TOKEN permissions: ${tokenCheck}`);
+      if (origGhToken !== undefined) {
+        process.env.GH_TOKEN = origGhToken;
+      } else {
+        delete process.env.GH_TOKEN;
+      }
+
       try {
-        runArgs(['git', 'push', '-u', 'origin', branch, '--force'], { cwd: rootDir });
+        runArgs(['git', 'push', '-u', 'origin', branch, '--force', '--verbose'], { cwd: rootDir });
       } catch (err) {
         // Redact token from error messages to prevent leakage in CI logs
         const msg = err instanceof Error ? err.message : String(err);
-        throw new Error(msg.replaceAll(token, '***'));
+        // Log the redacted stderr for debugging
+        const redacted = msg.replaceAll(token, '***');
+        log.error(redacted);
+        throw new Error(redacted);
       }
     } finally {
-      // Restore original URL, extraheader, and includeIf entries
+      // Restore original URL (both fetch and push), extraheader, and includeIf entries
       if (originalUrl) {
         runArgs(['git', 'remote', 'set-url', 'origin', originalUrl], { cwd: rootDir });
+        runArgs(['git', 'remote', 'set-url', 'origin', originalUrl, '--push'], { cwd: rootDir });
       }
       if (savedHeader) {
         runArgs(['git', 'config', '--local', extraHeaderKey, savedHeader], { cwd: rootDir });