Set persist-credentials: false on actions/checkout - #10
Open
anish-sujanani wants to merge 1 commit into
Open
Conversation
actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting persist-credentials: false removes it, as defence in depth against a later step exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Set
persist-credentials: falseonactions/checkoutactions/checkoutwrites a credential for theGITHUB_TOKENinto.git/configand leaves itthere for the rest of the job. Nothing in this repository is leaking it today — this change removes
the material that a later mistake would expose: an artifact upload whose path includes the
repository root, a debug step that prints git config, a broad Docker build context, or a
dependency's install script reading the workspace.
What changed
1
actions/checkoutstep across 1 workflow file. One or twoadded lines per step; nothing else moves.
postman.yaml→postmanWhy this is safe here
The job(s) changed here perform no
gitorghoperation against the origin — nothing reads the credential from.git/config— so behaviour is unchanged.A job only depends on the persisted credential if it runs
git pushorgit tagagainst theorigin. Where a token is passed explicitly — via
env:or as an action input — it is unaffected bythis change, because
ghand actions read it from the environment rather than from git's config.Verification
The edit was checked three ways before raising: the parsed YAML is identical once the added keys
are stripped, the number of added lines matches the number of
actions/checkoutsteps in eachfile, and
actionlintreports no new issues.If this breaks something
Say so and I will revert it — a defence-in-depth change is not worth a broken pipeline. If a job
turns out to need the credential, the fix is to authenticate explicitly rather than ambiently
(
git push "https://x-access-token:$GH_TOKEN@github.com/$GITHUB_REPOSITORY.git" ...) and I amhappy to make that change instead.
Raised as part of a CI/CD security posture review (control PM_GH_REPO_036).