From 41c90736f23d6095cdf16baf032c3f9b836e3b74 Mon Sep 17 00:00:00 2001 From: Anish Sujanani Date: Thu, 17 Sep 2026 10:58:00 +0530 Subject: [PATCH] Set persist-credentials: false on actions/checkout actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting persist-credentials: false removes it, as defence in depth against a later step exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036. --- .github/workflows/ci.yml | 4 ++++ .github/workflows/docker-build.yml | 2 ++ .github/workflows/e2e-tests.yml | 2 ++ 3 files changed, 8 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1c7a544d..f6174ebd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,6 +20,8 @@ jobs: steps: - name: 📥 Checkout code uses: actions/checkout@v4 + with: + persist-credentials: false - name: 📦 Setup pnpm uses: pnpm/action-setup@v2 @@ -58,6 +60,8 @@ jobs: steps: - name: 📥 Checkout code uses: actions/checkout@v4 + with: + persist-credentials: false - name: 📦 Setup pnpm uses: pnpm/action-setup@v2 diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 759cbf31..686dd9de 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -22,6 +22,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index 6a87017c..dce6ea10 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -20,6 +20,8 @@ jobs: steps: - name: 📥 Checkout code uses: actions/checkout@v4 + with: + persist-credentials: false - name: 📦 Setup pnpm uses: pnpm/action-setup@v2