From 070fd6056dfd8673e591606b4a7639916a412c7c Mon Sep 17 00:00:00 2001 From: Benoit Tigeot Date: Wed, 29 Jul 2026 17:20:54 +0200 Subject: [PATCH] ci: stop persisting checkout credentials in workflows Set `persist-credentials: false` on every `actions/checkout` so the auto-injected token is not left in `.git/config`, where a later step or uploaded artifact could leak it. Signed-off-by: Benoit Tigeot --- .github/workflows/build-test.yml | 2 ++ .github/workflows/codeql-analysis.yml | 2 ++ .github/workflows/golangci-lint.yml | 2 ++ .github/workflows/release.yml | 2 ++ 4 files changed, 8 insertions(+) diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 9503674ed..bdd3cc5b8 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -19,6 +19,8 @@ jobs: steps: - name: Checkout source code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1 + with: + persist-credentials: false - name: Add variables to environment file run: cat ".github/env" >> "$GITHUB_ENV" - name: Setup Go diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index d8c1a9d12..b978bca88 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -45,6 +45,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1 + with: + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 955f12002..2a359568d 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -14,6 +14,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1 + with: + persist-credentials: false - name: Add variables to environment file run: cat ".github/env" >> "$GITHUB_ENV" - name: Setup Go diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2b2f93f4d..af265a689 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,6 +23,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Add variables to environment file run: cat ".github/env" >> "$GITHUB_ENV" @@ -88,6 +89,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Add variables to environment file run: cat ".github/env" >> "$GITHUB_ENV"