From 165cad05fa7a279bc6a535a8ae17fa5abc6a9e0b Mon Sep 17 00:00:00 2001 From: jrfnl Date: Mon, 29 Dec 2025 01:26:47 +0100 Subject: [PATCH] GH Actions: do not persist credentials > By default, using `actions/checkout` causes a credential to be persisted in the checked-out repo's `.git/config`, so that subsequent `git` operations can be authenticated. > > Subsequent steps may accidentally publicly persist `.git/config`, e.g. by including it in a publicly accessible artifact via `actions/upload-artifact`. > > However, even without this, persisting the credential in the `.git/config` is non-ideal unless actually needed. > > **Remediation** > > Unless needed for `git` operations, `actions/checkout` should be used with `persist-credentials: false`. > > If the persisted credential is needed, it should be made explicit with `persist-credentials: true`. This has now been addressed in all workflows. Refs: * https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/ * https://docs.zizmor.sh/audits/#artipacked --- .github/workflows/reusable-actionlint.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/reusable-actionlint.yml b/.github/workflows/reusable-actionlint.yml index bad51d6..aefa359 100644 --- a/.github/workflows/reusable-actionlint.yml +++ b/.github/workflows/reusable-actionlint.yml @@ -27,6 +27,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + with: + persist-credentials: false - name: Add problem matcher if: ${{ github.event_name == 'pull_request' }}