Repository navigation
Keep the checkout token off disk, and pin the release action to a commit - #76
Merged
Merged
Conversation
actions/checkout persists the job's GITHUB_TOKEN by default, in a credentials file that git config points at, so every later step can read it, npm ci's install scripts included. In release.yml that token can write (contents: write, to create the Release), and no step uses git with it: the release action takes the token as an input and talks to the API. Checkout now sets persist-credentials: false there, and in ci.yml too, which runs the same npm ci on every pull request and so proves the install needs no stored credentials before a release relies on it. softprops/action-gh-release is a third-party action that runs holding that write token, and it was pinned by the movable tag v3. It is now pinned to efb35369, the commit v3 and v3.0.3 point at today, so a moved tag cannot change what runs in a release.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two hardening changes to the workflows, from the security sweep after the code-scanning alerts were closed. Neither changes what CI or a release builds.
1.
persist-credentials: falseon checkout, inrelease.ymlandci.yml. By defaultactions/checkoutkeeps the job'sGITHUB_TOKENin a credentials file that git config points at, so every later step can read it,npm ci's dependency install scripts included. Inrelease.ymlthat token can write (contents: write, to create the Release). No step there uses git with it: the release action takes the token as an input and calls the API.ci.ymlgets the same setting. It runs the samenpm cion every pull request, so this PR's own CI proves the install needs no stored credentials before a release depends on that.2.
softprops/action-gh-releasepinned to a commit. It is a third-party action that runs holding the release's write token, and it was referenced by the movable tagv3. It is now@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3, the commitv3andv3.0.3point at today (resolved through the GitHub API: thev3tag object dereferences to that commit, andv3.0.3is the latest release, published 2026-08-30). First-partyactions/checkoutandactions/setup-nodestay on their major tags.Checked: both files still parse, and step for step they equal the old ones except for the checkout
with:and the release action'suses:. The job names are unchanged.release.ymlitself only runs on a tag, so its first exercise is the next release; the checkout change in it is the same one this PR's CI runs.