From fa3e01f7c719a1133e15a93b663e26e3028b1b6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?= Date: Wed, 30 Sep 2026 13:18:20 +0000 Subject: [PATCH] :construction_worker: Disable checkout credential persistence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Set persist-credentials: false on every actions/checkout step, so the job token is not left in .git/config for the rest of the job. No step after checkout pushes or fetches with it. The only authenticated operation, gh release in release.yml, uses GH_TOKEN. Signed-off-by: David Barragán Merino --- .github/workflows/build-bundle.yml | 2 ++ .github/workflows/build-docker-devenv.yml | 2 ++ .github/workflows/build-docker.yml | 2 ++ .github/workflows/plugins-deploy-api-doc.yml | 1 + .github/workflows/plugins-deploy-package.yml | 1 + .github/workflows/plugins-deploy-packages.yml | 2 ++ .../workflows/plugins-deploy-styles-doc.yml | 1 + .github/workflows/release.yml | 1 + .github/workflows/tests-backend.yml | 2 ++ .github/workflows/tests-common.yml | 2 ++ .github/workflows/tests-e2e.yml | 7 +++++++ .github/workflows/tests-exporter.yml | 2 ++ .github/workflows/tests-frontend.yml | 2 ++ .github/workflows/tests-library.yml | 2 ++ .github/workflows/tests-mcp.yml | 2 ++ .github/workflows/tests-plugins.yml | 2 ++ .github/workflows/tests-wasm.yml | 2 ++ .github/zizmor.yml | 20 ------------------- 18 files changed, 35 insertions(+), 20 deletions(-) diff --git a/.github/workflows/build-bundle.yml b/.github/workflows/build-bundle.yml index 6295834e30..5cecd3e233 100644 --- a/.github/workflows/build-bundle.yml +++ b/.github/workflows/build-bundle.yml @@ -56,6 +56,7 @@ jobs: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false fetch-depth: 0 ref: ${{ inputs.gh_ref }} @@ -123,6 +124,7 @@ jobs: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false fetch-depth: 0 ref: ${{ inputs.gh_ref }} diff --git a/.github/workflows/build-docker-devenv.yml b/.github/workflows/build-docker-devenv.yml index c7093e002f..39d3c2594f 100644 --- a/.github/workflows/build-docker-devenv.yml +++ b/.github/workflows/build-docker-devenv.yml @@ -16,6 +16,8 @@ jobs: - name: Checkout code uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index ee1ea61c07..6970b9b026 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -67,6 +67,7 @@ jobs: - name: Checkout code uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false fetch-depth: 0 ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }} @@ -161,6 +162,7 @@ jobs: - name: Checkout code uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }} - name: Login to Docker Registry diff --git a/.github/workflows/plugins-deploy-api-doc.yml b/.github/workflows/plugins-deploy-api-doc.yml index b3efd118c5..a3598af4bd 100644 --- a/.github/workflows/plugins-deploy-api-doc.yml +++ b/.github/workflows/plugins-deploy-api-doc.yml @@ -41,6 +41,7 @@ jobs: - name: Checkout uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false fetch-depth: 0 ref: ${{ steps.vars.outputs.gh_ref }} diff --git a/.github/workflows/plugins-deploy-package.yml b/.github/workflows/plugins-deploy-package.yml index 71700801c7..83fa91df3c 100644 --- a/.github/workflows/plugins-deploy-package.yml +++ b/.github/workflows/plugins-deploy-package.yml @@ -60,6 +60,7 @@ jobs: - name: Checkout uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false fetch-depth: 0 ref: ${{ inputs.gh_ref }} diff --git a/.github/workflows/plugins-deploy-packages.yml b/.github/workflows/plugins-deploy-packages.yml index a05b7b5944..ee269ba616 100644 --- a/.github/workflows/plugins-deploy-packages.yml +++ b/.github/workflows/plugins-deploy-packages.yml @@ -37,6 +37,8 @@ jobs: # Add more outputs here steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - id: filter uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 with: diff --git a/.github/workflows/plugins-deploy-styles-doc.yml b/.github/workflows/plugins-deploy-styles-doc.yml index 9610045f4e..3c04eb6b58 100644 --- a/.github/workflows/plugins-deploy-styles-doc.yml +++ b/.github/workflows/plugins-deploy-styles-doc.yml @@ -39,6 +39,7 @@ jobs: - name: Checkout uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false fetch-depth: 0 ref: ${{ steps.vars.outputs.gh_ref }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7b7e6a1a1f..8aa43c26c3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,6 +34,7 @@ jobs: - name: Checkout code uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false fetch-depth: 0 ref: ${{ steps.vars.outputs.gh_ref }} diff --git a/.github/workflows/tests-backend.yml b/.github/workflows/tests-backend.yml index 580f24002d..1557a8685a 100644 --- a/.github/workflows/tests-backend.yml +++ b/.github/workflows/tests-backend.yml @@ -61,6 +61,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Fmt working-directory: ./backend diff --git a/.github/workflows/tests-common.yml b/.github/workflows/tests-common.yml index 560a5b6427..b622958277 100644 --- a/.github/workflows/tests-common.yml +++ b/.github/workflows/tests-common.yml @@ -40,6 +40,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Lint working-directory: ./common diff --git a/.github/workflows/tests-e2e.yml b/.github/workflows/tests-e2e.yml index b32b0e3868..07e1cc47a9 100644 --- a/.github/workflows/tests-e2e.yml +++ b/.github/workflows/tests-e2e.yml @@ -109,6 +109,7 @@ jobs: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false ref: ${{ inputs.gh_ref }} # The cache key must come from the SHA actually checked out: on a manual @@ -165,6 +166,7 @@ jobs: - name: Checkout Repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false ref: ${{ inputs.gh_ref }} - name: Restore Cache @@ -235,6 +237,8 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false # The driver serves the prebuilt bundle from frontend/resources/public. - name: Restore Cache @@ -273,6 +277,8 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false # Mocked mode serves the prebuilt bundle from frontend/resources/public. - name: Restore Cache @@ -320,6 +326,7 @@ jobs: - name: Checkout Repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false ref: ${{ inputs.gh_ref }} - name: Install deps diff --git a/.github/workflows/tests-exporter.yml b/.github/workflows/tests-exporter.yml index 7f74d97390..8441af3a75 100644 --- a/.github/workflows/tests-exporter.yml +++ b/.github/workflows/tests-exporter.yml @@ -44,6 +44,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Lint working-directory: ./exporter diff --git a/.github/workflows/tests-frontend.yml b/.github/workflows/tests-frontend.yml index a2f3453763..8fcfdc8066 100644 --- a/.github/workflows/tests-frontend.yml +++ b/.github/workflows/tests-frontend.yml @@ -44,6 +44,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Lint working-directory: ./frontend diff --git a/.github/workflows/tests-library.yml b/.github/workflows/tests-library.yml index a434a71e34..df2c478ca1 100644 --- a/.github/workflows/tests-library.yml +++ b/.github/workflows/tests-library.yml @@ -42,6 +42,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Lint working-directory: ./library diff --git a/.github/workflows/tests-mcp.yml b/.github/workflows/tests-mcp.yml index 1e7e46d57d..68ff0584bd 100644 --- a/.github/workflows/tests-mcp.yml +++ b/.github/workflows/tests-mcp.yml @@ -34,6 +34,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Setup working-directory: ./mcp diff --git a/.github/workflows/tests-plugins.yml b/.github/workflows/tests-plugins.yml index c18fc4c55b..180f125489 100644 --- a/.github/workflows/tests-plugins.yml +++ b/.github/workflows/tests-plugins.yml @@ -39,6 +39,8 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Install deps working-directory: ./plugins diff --git a/.github/workflows/tests-wasm.yml b/.github/workflows/tests-wasm.yml index cc58fa0ccf..fdbc8820ff 100644 --- a/.github/workflows/tests-wasm.yml +++ b/.github/workflows/tests-wasm.yml @@ -40,6 +40,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Format working-directory: ./render-wasm diff --git a/.github/zizmor.yml b/.github/zizmor.yml index b6acd14809..03445803e4 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -12,26 +12,6 @@ rules: - plugins-deploy-api-doc.yml - plugins-deploy-package.yml - plugins-deploy-styles-doc.yml - # Use `persist-credentials: false` in actions/checkout. - artipacked: - ignore: - - build-bundle.yml - - build-docker-devenv.yml - - build-docker.yml - - plugins-deploy-api-doc.yml - - plugins-deploy-package.yml - - plugins-deploy-packages.yml - - plugins-deploy-styles-doc.yml - - release.yml - - tests-backend.yml - - tests-common.yml - - tests-e2e.yml - - tests-exporter.yml - - tests-frontend.yml - - tests-library.yml - - tests-mcp.yml - - tests-plugins.yml - - tests-wasm.yml # Avoid restoring caches in release/publish workflows. cache-poisoning: ignore: