From 6f3b28064a7ed4b7267d71f035fbe1c16ca42ff2 Mon Sep 17 00:00:00 2001 From: Anish Sujanani Date: Mon, 7 Sep 2026 11:59:11 +0530 Subject: [PATCH] Set persist-credentials: false on actions/checkout actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting persist-credentials: false removes it, as defence in depth against a later step exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036. --- .github/workflows/postman.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/postman.yaml b/.github/workflows/postman.yaml index b29b2d6..ff15192 100644 --- a/.github/workflows/postman.yaml +++ b/.github/workflows/postman.yaml @@ -12,6 +12,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - run: curl -o- "https://dl-cli.pstmn.io/install/unix.sh" | sh