Pin third-party actions to commit SHAs - #61
Open
kurtismash wants to merge 2 commits into
Open
zizmor PR Scanner / zizmor 🌈
completed
Apr 22, 2026 in 4s
zizmor found 1 finding(s)
zizmor 🌈 found 1 warning(s) in your GitHub Actions workflows.
See the annotations for details.
Annotations
Check warning on line 19 in .github/workflows/ci.yml
zizmor-pr-scanner / zizmor 🌈
artipacked
credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
By default, `actions/checkout` persists credentials on disk. Subsequent steps may accidentally expose them, e.g. via a publicly accessible artifact.
How to fix: Use `actions/checkout` with `persist-credentials: false` unless your workflow explicitly needs git credentials. If the persisted credential is needed, it should be made explicit with `persist-credentials: true`.
See https://docs.zizmor.sh/audits/#artipacked for more information.
Loading