Don't persist checkout action credentials in later steps
https://github.com/actions/checkout/issues/485
Martin Weinelt committed
Apr 6, 2025 at 16:36 UTC
d53d8f2434a11fe8f094a08148545a772639e77c
3 files changed
+12
.github/workflows/ci.yml
+8
@@ -24,6 +24,8 @@ jobs:
24
- macos-latest
25
steps:
26
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
27
+ with:
28
+ persist-credentials: false
29
- uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
30
- uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
31
with:
@@ -45,6 +47,8 @@ jobs:
47
- mimas
48
steps:
49
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
50
+ with:
51
+ persist-credentials: false
52
- uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
53
- uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
54
with:
@@ -61,6 +65,8 @@ jobs:
65
- goofy-hopcroft
66
steps:
67
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
68
+ with:
69
+ persist-credentials: false
70
- uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
71
- uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
72
with:
@@ -77,6 +83,8 @@ jobs:
83
- m2-large
84
steps:
85
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
86
+ with:
87
+ persist-credentials: false
88
- uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
89
- uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
90
with:
.github/workflows/dns-apply.yml
+2
@@ -18,6 +18,8 @@ jobs:
18
fail-fast: true
19
steps:
20
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21
+ with:
22
+ persist-credentials: false
23
- uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
24
- name: dnscontrol push
25
env:
.github/workflows/dns-preview.yml
+2
@@ -15,6 +15,8 @@ jobs:
15
fail-fast: false
16
steps:
17
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
18
+ with:
19
+ persist-credentials: false
20
- uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
21
- name: dnscontrol preview
22
if: github.repository == 'nixos/infra'