绝对不会为此感到自豪，但不得不在CI环境中求助于一些肮脏的东西，也是因为“原因”...
这两种解决方案都不是理想的，但最简单的方法是在gitconfig中创建一个shell别名，并添加到从stdin读取令牌的.bashrc/.zshrc中

## example that shows header is set correctly but does not show up actual value in command line history  
## replace `whoami` command with command/script to retrieve token
$ GIT_CURL_VERBOSE=1 git -c http.extraHeader="Hello: $(whoami)" ls-remote https://github.com/deric4/github-action-runner-reference
...
15:43:52.454783 http.c:701              == Info: using HTTP/2
15:43:52.454838 http.c:701              == Info: h2h3 [:method: GET]
15:43:52.454844 http.c:701              == Info: h2h3 [:path: /deric4/github-action-runner-reference/info/refs?service=git-upload-pack]
15:43:52.454849 http.c:701              == Info: h2h3 [:scheme: https]
15:43:52.454853 http.c:701              == Info: h2h3 [:authority: github.com]
15:43:52.454857 http.c:701              == Info: h2h3 [user-agent: git/2.39.2 (Apple Git-143)]
15:43:52.454861 http.c:701              == Info: h2h3 [accept: */*]
15:43:52.454865 http.c:701              == Info: h2h3 [accept-encoding: deflate, gzip]
15:43:52.454869 http.c:701              == Info: h2h3 [hello: deric4]
15:43:52.454873 http.c:701              == Info: h2h3 [pragma: no-cache]
15:43:52.454876 http.c:701              == Info: h2h3 [git-protocol: version=2]
...

# .gitconfig
[alias]
    myalias = "!f() { GIT_CURL_VERBOSE=1 git -c http.extraHeader=\"Hello: $(whoami)\" ls-remote $1 ; }; f"

一种更激进的方法是实现自定义的remote helper来添加/代替凭证助手。
我能够挖掘出一个我并不引以为傲但却完成了任务的老例子：
这将允许基于执行上下文动态地获取和设置配置/凭证。
git clone accesstoken://some-profile@foo-bar-baz

// Note: that this was written in go 1.12 and hadn't looked at it since then so...
func main() {

    remoteName := os.Args[1]
    repoUrl := os.Args[2]

    u, err := url.Parse(repoUrl)
    if err != nil {
        log.Fatal(err)
    }
    
    // replaced complex steps to just getting the env var
    accessToken := os.Getenv("GIT_ACCESS_TOKEN")

    // get username so it can be reset when password is added
    username := u.User.Username()

    // construct <username>:<password>
    u.User = url.UserPassword(username, accessToken)

    // convert from accesstoken -> https
    u.Scheme = "https"

    cmd := exec.Command("git", "remote-http", remoteName, u.String())
    cmd.Stdout = os.Stdout
    cmd.Stderr = os.Stderr
    cmd.Stdin = os.Stdin

    err = cmd.Run()
    if err != nil {
        log.Fatal(err)
    }
}

但你的情况是

// custom logic to get bearer token
    
    cmd := exec.Command("git", "-c", "http.extraHeader='Bearer: <token from somewhere>'", "remote-http", remoteName, u.String())