[clubanderson]

Sets persist-credentials: false on the actions/checkout step of the five pull_request workflows that run scripts, tests or image builds from the PR tree:

• mutation-advisory.yml
• pr-overlap.yml
• stream-image.yml
• ci-runner-image.yml
• docs-index-reminder.yml

None of these jobs pushes or fetches with the job token (pr-overlap.sh fetches public refs; API calls take GH_TOKEN/github.token from step env, scoped by each job's permissions: block), so nothing in the job needs the credential left in .git/config. changelog-fragment-guard.yml already sets it; the only step there that pushes uses PUSH_TOKEN from step env.

Decision on the proposal: accept — every pull_request/pull_request_target job that runs PR-tree code checks out without persisted credentials; credentials are kept only where a later step pushes or comments, scoped via permissions:. Workflow files need a human push, hence this PR.

Includes a changelog.d/changed-* fragment.

Fixes #17636

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[clubanderson]

/lgtm
/approve

[kubestellar-prow]

@clubanderson: you cannot LGTM your own PR.

Details

In response to this:

/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [clubanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[github-actions]

Changelog fragment in the wrong directory

Fragments live in changelog.d/ at the repository root, not under src/. Files under src/changelog.d/ are never compiled into CHANGELOG.md, so the changelog-fragment-guard check fails. Move them and push:

git mv src/changelog.d/changed-checkout-no-persist-credentials.md changelog.d/changed-checkout-no-persist-credentials.md
git commit -s -m "changelog: move fragment to repo-root changelog.d/"

See changelog.d/README.md (#5675, #11919). This comment is removed automatically once nothing is misplaced.

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• changelog-fragment-guard

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

[hivecommons-hive]

Decision needed: @clubanderson should confirm this workflow-file change (checkout persist-credentials: false on five pull_request workflows) is intended to land as-is once the changelog fragment is moved to the repository root.

One blocking issue, otherwise the change does what it says.

Changelog fragment is in the wrong directory — this is why changelog-fragment-guard is red.
src/changelog.d/changed-checkout-no-persist-credentials.md is under src/; fragments live at the repository root. src/changelog.d/README.md:1-13 says exactly this: src/scripts/compile-changelog.sh only reads the root changelog.d/, so a fragment here is never compiled into CHANGELOG.md and the guard rejects it (#11919). Fix:

git mv src/changelog.d/changed-checkout-no-persist-credentials.md changelog.d/

The workflow change itself checks out. I read the five workflows at the base tree: none runs git push/git fetch/git ls-remote after checkout. mutation-advisory.yml:51, pr-overlap.yml:33, docs-index-reminder.yml:55,90 take the token via step env (GH_TOKEN), which is unaffected by persist-credentials. stream-image.yml and ci-runner-image.yml are build-only on pull_request (stream-image.yml:21, ci-runner-image.yml:39) and push images with a registry login, not the git credential. The latest Build (PR gate, no push) run on this head (43043477832) passed, so the FAILURE in the checks rollup is a superseded run, not this diff.

This touches .github/workflows/, so I am routing rather than calling it done: it is a privilege reduction, authored by the repository owner, and I found nothing in it that weakens a check or widens a permission. I have not changed anything.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

7af024e

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head 7af024ef736d) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 5 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/ci-runner-image.yml
  • .github/workflows/docs-index-reminder.yml
  • .github/workflows/mutation-advisory.yml
  • .github/workflows/pr-overlap.yml
  • .github/workflows/stream-image.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Triage of the three red checks on 7af024e:

• changelog-fragment-guard — PR-local: the fragment is at src/changelog.d/changed-checkout-no-persist-credentials.md; it must live at the repo root. git mv src/changelog.d/changed-checkout-no-persist-credentials.md changelog.d/ and push.
• native-queue-policy — downstream of the guard above (Error: changelog-fragment-guard: failure); clears on its own once the fragment moves.
• Build (PR gate, no push) — runner infrastructure, not this diff: the Docker build's apt-get update could not resolve azure.archive.ubuntu.com / ppa.launchpadcontent.net (DNS), exit 100. v5 is green on the same workflow at 5a1f8cf. The next push for the fragment move will re-run it.

Human-authored PR, so the hive is not pushing to this branch.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88