From 1c9b7253bf334ad2bee7cf93a69bb9b4901040f7 Mon Sep 17 00:00:00 2001 From: Wei Wang Date: Sun, 11 Oct 2026 20:35:01 -0400 Subject: [PATCH] Keep the checkout token off disk, and pin the release action to a commit actions/checkout persists the job's GITHUB_TOKEN by default, in a credentials file that git config points at, so every later step can read it, npm ci's install scripts included. In release.yml that token can write (contents: write, to create the Release), and no step uses git with it: the release action takes the token as an input and talks to the API. Checkout now sets persist-credentials: false there, and in ci.yml too, which runs the same npm ci on every pull request and so proves the install needs no stored credentials before a release relies on it. softprops/action-gh-release is a third-party action that runs holding that write token, and it was pinned by the movable tag v3. It is now pinned to efb35369, the commit v3 and v3.0.3 point at today, so a moved tag cannot change what runs in a release. --- .github/workflows/ci.yml | 4 ++++ .github/workflows/release.yml | 9 ++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b00e3d8c..cf6e304a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,11 @@ jobs: build-and-test: runs-on: ubuntu-latest steps: + # No later step uses git with the token, so checkout does not keep it. + # This also proves, on every PR, the npm ci that release.yml runs the same way. - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: actions/setup-node@v7 with: node-version: '22' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cd0e6ef8..a7e75f8d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,7 +23,12 @@ jobs: release: runs-on: ubuntu-latest steps: + # This job's token can write (it creates the Release), so checkout does + # not leave it on disk for npm ci's install scripts and the build to read. + # The release action below is handed the token as an input instead. - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: actions/setup-node@v7 with: @@ -48,6 +53,8 @@ jobs: run: npm run verify - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + # A third-party action that holds the write token, pinned to the commit + # its v3.0.3 tag points at, so a moved tag cannot change what runs here. + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: generate_release_notes: true