From e9846182ebcce387c6ed079da7a6f22859642d15 Mon Sep 17 00:00:00 2001 From: Anish Sujanani Date: Thu, 17 Sep 2026 10:55:46 +0530 Subject: [PATCH] Set persist-credentials: false on actions/checkout actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting persist-credentials: false removes it, as defence in depth against a later step exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036. --- .github/workflows/beta-deploy.yml | 2 ++ .github/workflows/ci.yml | 2 ++ .github/workflows/manual-rerun.yml | 2 ++ .github/workflows/prod-deploy.yml | 2 ++ 4 files changed, 8 insertions(+) diff --git a/.github/workflows/beta-deploy.yml b/.github/workflows/beta-deploy.yml index 9fc0e66..e28c98e 100644 --- a/.github/workflows/beta-deploy.yml +++ b/.github/workflows/beta-deploy.yml @@ -20,6 +20,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v2 + with: + persist-credentials: false - name: Setup Node uses: actions/setup-node@master diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4c03884..33631bd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,8 @@ jobs: steps: - uses: actions/checkout@v1 + with: + persist-credentials: false - uses: actions/setup-node@master with: node-version: '18.20.5' diff --git a/.github/workflows/manual-rerun.yml b/.github/workflows/manual-rerun.yml index a4ec9e5..b691988 100644 --- a/.github/workflows/manual-rerun.yml +++ b/.github/workflows/manual-rerun.yml @@ -8,6 +8,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v1 + with: + persist-credentials: false - uses: actions/setup-node@master with: node-version: '18.20.5' diff --git a/.github/workflows/prod-deploy.yml b/.github/workflows/prod-deploy.yml index fed9ad7..00590b4 100644 --- a/.github/workflows/prod-deploy.yml +++ b/.github/workflows/prod-deploy.yml @@ -17,6 +17,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v2 + with: + persist-credentials: false - name: Setup Node uses: actions/setup-node@master