From dd2a0b713ddf8f38f51fe12e936d2aeaa57eabee Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Thu, 6 Aug 2026 11:10:25 -0400 Subject: [PATCH] fix(ci): do not persist the job token in .git/config in the public-repo guard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actions/checkout without persist-credentials:false leaves GITHUB_TOKEN readable in .git/config for every later step — including the one that downloads and executes the gitleaks binary. Nothing in this job uses the credential (contents:read, gitleaks runs --no-git, no gh/push steps). Refs #1870. --- .github/workflows/public-repo-guard.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/public-repo-guard.yml b/.github/workflows/public-repo-guard.yml index 719718a..d232941 100644 --- a/.github/workflows/public-repo-guard.yml +++ b/.github/workflows/public-repo-guard.yml @@ -43,6 +43,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + with: + persist-credentials: false # gitleaks' GitHub Action requires a paid license for organizations; the CLI # itself is MIT-licensed and free. Pin the version AND verify the release