From 7af024ef736d64c7e76c7aad7841f0657d57141a Mon Sep 17 00:00:00 2001 From: Andrew Anderson Date: Wed, 11 Nov 2026 07:57:06 -0700 Subject: [PATCH] =?UTF-8?q?=F0=9F=8C=B1=20ci:=20stop=20persisting=20checko?= =?UTF-8?q?ut=20credentials=20in=20PR-tree=20workflows?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Set persist-credentials: false on the actions/checkout step of the five pull_request workflows that run scripts, tests or image builds from the PR tree (mutation-advisory, pr-overlap, stream-image, ci-runner-image, docs-index-reminder). None of them pushes or fetches with the job token; API calls keep getting it via step env under the job's permissions block. Fixes #17636 Signed-off-by: Andrew Anderson --- .github/workflows/ci-runner-image.yml | 2 ++ .github/workflows/docs-index-reminder.yml | 2 ++ .github/workflows/mutation-advisory.yml | 1 + .github/workflows/pr-overlap.yml | 1 + .github/workflows/stream-image.yml | 2 ++ src/changelog.d/changed-checkout-no-persist-credentials.md | 1 + 6 files changed, 9 insertions(+) create mode 100644 src/changelog.d/changed-checkout-no-persist-credentials.md diff --git a/.github/workflows/ci-runner-image.yml b/.github/workflows/ci-runner-image.yml index 69705fe271..9982bcf61b 100644 --- a/.github/workflows/ci-runner-image.yml +++ b/.github/workflows/ci-runner-image.yml @@ -106,6 +106,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # Resolve the base image and the tag once, up front, so every later step # (the exists-check, the build, the summary) agrees on them. diff --git a/.github/workflows/docs-index-reminder.yml b/.github/workflows/docs-index-reminder.yml index 8db796ca3b..88a9a8f0cc 100644 --- a/.github/workflows/docs-index-reminder.yml +++ b/.github/workflows/docs-index-reminder.yml @@ -48,6 +48,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Find docs added by this PR that the index does not link id: check diff --git a/.github/workflows/mutation-advisory.yml b/.github/workflows/mutation-advisory.yml index 4b1cfb0f9c..6852a01dc2 100644 --- a/.github/workflows/mutation-advisory.yml +++ b/.github/workflows/mutation-advisory.yml @@ -26,6 +26,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: diff --git a/.github/workflows/pr-overlap.yml b/.github/workflows/pr-overlap.yml index e959ff8dc1..d439ffc1d4 100644 --- a/.github/workflows/pr-overlap.yml +++ b/.github/workflows/pr-overlap.yml @@ -23,6 +23,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 # Hermetic (local repos + gh double), under a second: a broken check # mislabels every open PR, so it must not ship untested (#9319). diff --git a/.github/workflows/stream-image.yml b/.github/workflows/stream-image.yml index 6bf45e2f18..f73a7ec646 100644 --- a/.github/workflows/stream-image.yml +++ b/.github/workflows/stream-image.yml @@ -73,6 +73,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # The supervisor scripts have no Go test lane; shellcheck them and run # the watchdog decision tests (fake ffmpeg, stubbed Twitch check) here, diff --git a/src/changelog.d/changed-checkout-no-persist-credentials.md b/src/changelog.d/changed-checkout-no-persist-credentials.md new file mode 100644 index 0000000000..fc0549e0f4 --- /dev/null +++ b/src/changelog.d/changed-checkout-no-persist-credentials.md @@ -0,0 +1 @@ +- CI: the `pull_request` workflows `mutation-advisory`, `pr-overlap`, `stream-image`, `ci-runner-image` and `docs-index-reminder` now check out with `persist-credentials: false`. None of those jobs pushes or fetches with the job token; steps that call the API keep getting it through their step `env`, scoped by the job's `permissions:` block (#17636).