fix(ci): do not persist the job token in .git/config in the public-repo guard by yakimoto · Pull Request #27 · wave-av/.github

yakimoto · 2026-08-06T15:10:47Z

Why

actions/checkout without persist-credentials: false writes the job's GITHUB_TOKEN into
.git/config, where any later step — or anything those steps execute — can read it. This is the
security gate that DOWNLOADS AND EXECUTES the gitleaks binary, and the workflow's own comment
already reasons about tampered downloads ("so a tampered or MITM'd download can never execute
inside the security gate"), so the threat model is written down and only the credential half of
the mitigation is missing. Found by zizmor as warning[artipacked]: credential persistence through GitHub Actions artifacts.

Safety

Verified this job only: checks out, installs gitleaks (pinned + checksum), runs
gitleaks detect --no-git, installs ripgrep, runs content-policy.sh. permissions: contents: read. Nothing pushes, calls gh, or reads GITHUB_TOKEN/GH_TOKEN, so the token was never needed
in .git/config in the first place.

Refs wave-av/claude-workstation#1870.

Note

Low Risk
Single workflow security hardening with no change to scan logic or permissions; reduces credential exposure without affecting functionality.

Overview
Hardens the public-repo-guard workflow by setting persist-credentials: false on actions/checkout, so the job token is not stored in .git/config for later steps or anything they run.

This aligns with the workflow’s existing threat model (pinned, checksum-verified gitleaks download): the job only reads the tree and runs scans with contents: read, so persisted credentials were unnecessary exposure.

^{Reviewed by Cursor Bugbot for commit 92dd382. Configure here.}

…po guard actions/checkout without persist-credentials:false leaves GITHUB_TOKEN readable in .git/config for every later step — including the one that downloads and executes the gitleaks binary. Nothing in this job uses the credential (contents:read, gitleaks runs --no-git, no gh/push steps). Refs #1870.

cursor · 2026-08-06T15:11:01Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_cc717a75-e326-47d6-9e26-23f80138a922)

macroscopeapp · 2026-08-06T15:11:28Z

Approvability

Verdict: Approved 92dd382

Minor CI/CD security hardening that adds persist-credentials: false to prevent job token persistence in .git/config. Self-contained change to a workflow file owned by the author.

^{You can customize Macroscope's approvability policy. Learn more.}

qodo-code-review · 2026-08-06T15:11:29Z

PR Summary by Qodo

Harden public-repo-guard checkout by disabling credential persistence

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Disable persisted checkout credentials to keep GITHUB_TOKEN out of .git/config
• Reduce exposure for later steps that download and execute third-party binaries

Diagram

graph TD
  GH["GitHub Actions runner"] --> CO["actions/checkout"] --> CFG[".git/config"]
  CO -->|"persist-credentials: false"| CFG
  GH --> SCAN["Guard steps"]
  SCAN -->|"read repo"| CO
  subgraph Legend
    direction LR
    _proc["Step/Job"] ~~~ _file["File"]
  end

High-Level Assessment

Setting persist-credentials: false on actions/checkout is the most direct and standard mitigation to prevent GITHUB_TOKEN from being written to .git/config. Alternatives (e.g., deleting .git/config entries later or relying on step hygiene) are weaker and more error-prone than preventing persistence at the source.

Files changed (1) +2 / -0

Other (1) +2 / -0

public-repo-guard.ymlDisable checkout credential persistence for public-repo-guard +2/-0

Disable checkout credential persistence for public-repo-guard

• Adds 'persist-credentials: false' to the 'actions/checkout' step so the job GITHUB_TOKEN is not stored in '.git/config'. This reduces the blast radius of subsequent steps that download and execute tooling while preserving the job’s read-only behavior.

.github/workflows/public-repo-guard.yml

qodo-code-review · 2026-08-06T15:11:51Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

devin-ai-integration

Devin Review found 3 potential issues.

devin-ai-integration · 2026-08-06T15:11:53Z

+        with:
+          persist-credentials: false


🟡 Shared copy of the security-gate workflow still leaves the job credential on disk

The hardening step that stops the job's credential from being written to disk (persist-credentials: false at .github/workflows/public-repo-guard.yml:46-47) was added only to this repo's own copy and not to the shared template other repositories install from, so every repo that copies the gate keeps the old, unhardened behavior.
Impact: Repos adopting the published guard template continue to expose the build credential to later steps, so the fix does not actually reach the repos it was meant to protect.

Divergence between the live workflow and the vendored workflow template

workflow-templates/public-repo-guard.yml is the copy the org's "install on a new repo" flow uses (the header at .github/workflows/public-repo-guard.yml:16-19 instructs copying the workflow file alongside .gitleaks.toml and scripts/public-repo-guard/content-policy.sh). A diff of the two files shows the only difference is the two newly added lines; workflow-templates/public-repo-guard.yml:45 still has a bare - uses: actions/checkout@... with no with: block.

Prompt for agents

The PR adds `with: persist-credentials: false` to the checkout step in .github/workflows/public-repo-guard.yml but the identical vendored copy at workflow-templates/public-repo-guard.yml (the file other repos install) was not updated. Apply the same change there so the two stay in sync; also consider whether the other workflow templates that call actions/checkout need the same hardening.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-06T15:11:54Z

      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+        with:
+          persist-credentials: false


🔍 Same hardening missing on other org workflows using checkout

A repo-wide grep shows persist-credentials appears only in the file changed by this PR. Other workflows (.github/workflows/issue-ops-triage.yml, .github/workflows/ticket-hygiene.yml) and several workflow-templates/*.yml also use actions/checkout without it. Some of those legitimately need the token, but a follow-up sweep would make the hardening consistent org-wide.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-06T15:11:56Z

+        with:
+          persist-credentials: false


🟨 Distributed guard workflow template still persists the job credential in .git/config

The hardening (persist-credentials: false) was applied only to .github/workflows/public-repo-guard.yml:46-47; the vendored copy at workflow-templates/public-repo-guard.yml:45, which is the version other repositories install, still checks out with credentials persisted. Any repo using that template continues to leave GITHUB_TOKEN readable in .git/config for subsequent steps, including the step that downloads and executes the gitleaks binary.

Was this helpful? React with 👍 or 👎 to provide feedback.

qodo-code-review · 2026-08-06T15:12:04Z

Qodo Fixer

No findings are available for this PR yet. Findings appear here once Qodo has reviewed the PR.

cubic-dev-ai

1 issue found across 1 file

Confidence score: 3/5

In workflow-templates/public-repo-guard.yml, the persist-credentials: false hardening is still missing, so repositories that install from this template could inherit the old behavior and unintentionally expose checkout credentials in CI runs—mirror the fix from .github/workflows/public-repo-guard.yml into the vendored template to prevent propagation.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/public-repo-guard.yml">

<violation number="1" location=".github/workflows/public-repo-guard.yml:47">
P2: The credential-persistence fix (persist-credentials: false) was added here but the vendored template at workflow-templates/public-repo-guard.yml, which other repositories copy when installing this guard, still has a bare `actions/checkout` step with no `with:` block. Repos that install from that template will continue to leave GITHUB_TOKEN in `.git/config` for the same gitleaks-download step this PR is hardening. Apply the same `persist-credentials: false` change to workflow-templates/public-repo-guard.yml.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai · 2026-08-06T15:14:40Z

    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+        with:
+          persist-credentials: false


P2: The credential-persistence fix (persist-credentials: false) was added here but the vendored template at workflow-templates/public-repo-guard.yml, which other repositories copy when installing this guard, still has a bare actions/checkout step with no with: block. Repos that install from that template will continue to leave GITHUB_TOKEN in .git/config for the same gitleaks-download step this PR is hardening. Apply the same persist-credentials: false change to workflow-templates/public-repo-guard.yml.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/public-repo-guard.yml, line 47: <comment>The credential-persistence fix (persist-credentials: false) was added here but the vendored template at workflow-templates/public-repo-guard.yml, which other repositories copy when installing this guard, still has a bare `actions/checkout` step with no `with:` block. Repos that install from that template will continue to leave GITHUB_TOKEN in `.git/config` for the same gitleaks-download step this PR is hardening. Apply the same `persist-credentials: false` change to workflow-templates/public-repo-guard.yml.</comment> <file context> @@ -43,6 +43,8 @@ jobs: steps: - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + with: + persist-credentials: false # gitleaks' GitHub Action requires a paid license for organizations; the CLI </file context>

yakimoto · 2026-08-06T15:53:18Z

This PR is redundant with #23 (chore/guard-canonical-sync), which is already open and already contains this exact change.

Evidence — #23's diff to .github/workflows/public-repo-guard.yml includes:

+          # tree. Nothing here pushes -- the scan is `--no-git` over the working tree --
+          # so no step needs authenticated Git; drop it. (zizmor: artipacked)
+          persist-credentials: false

#23 is also broader than this PR: it syncs the whole vendored public-repo-guard trio to
the canonical source (wave-foundation/scaffolder/public-repo-guard) byte-for-byte, verified by
git blob SHA, rather than adding this one line in isolation.

Closing as redundant. This duplicate exists because the fan-out that opened this PR
(refs claude-workstation#1870) did not check for in-flight PRs touching the same file before
going out — #23 was already open. Merge #23 instead.

macroscopeapp Bot approved these changes Aug 6, 2026

View reviewed changes

devin-ai-integration Bot reviewed Aug 6, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Aug 6, 2026

View reviewed changes

yakimoto closed this Aug 6, 2026

Navigation Menu

Uh oh!

fix(ci): do not persist the job token in .git/config in the public-repo guard - #27

fix(ci): do not persist the job token in .git/config in the public-repo guard#27
yakimoto wants to merge 1 commit into
mainfrom
fix/1870-persist-credentials-false

yakimoto commented Aug 6, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cursor Bot commented Aug 6, 2026

Uh oh!

macroscopeapp Bot commented Aug 6, 2026

Uh oh!

qodo-code-review Bot commented Aug 6, 2026

Uh oh!

qodo-code-review Bot commented Aug 6, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Aug 6, 2026

Uh oh!

devin-ai-integration Bot Aug 6, 2026

Uh oh!

devin-ai-integration Bot Aug 6, 2026

Uh oh!

qodo-code-review Bot commented Aug 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot Aug 6, 2026 •

edited

Loading

Uh oh!

yakimoto commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

yakimoto commented Aug 6, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

Safety

Uh oh!

cursor Bot commented Aug 6, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

macroscopeapp Bot commented Aug 6, 2026

Approvability

Uh oh!

qodo-code-review Bot commented Aug 6, 2026

PR Summary by Qodo

Uh oh!

qodo-code-review Bot commented Aug 6, 2026

Code Review by Qodo

Great, no issues found!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-code-review Bot commented Aug 6, 2026

Qodo Fixer

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yakimoto commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

yakimoto commented Aug 6, 2026 •

edited by cubic-dev-ai Bot

Loading

cubic-dev-ai Bot Aug 6, 2026 •

edited

Loading