checkout without persisting credentials (#1374)

.github/actions/devcontainer_run_command/action.yml

@@ -121,6 +121,8 @@ runs:
   steps:
     - name: Checkout
       uses: actions/checkout@v2
+      with:
+        persist-credentials: false
 
     - name: Login to Container Registry
       uses: docker/login-action@v1

.github/workflows/build_docker_images.yml

@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Filter changes
         uses: dorny/paths-filter@v2

.github/workflows/build_docs.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v2
         with:
           python-version: 3.x

.github/workflows/clean_validation_envs.yml

@@ -18,6 +18,7 @@ jobs:
         with:
           # This is CRITICAL since we're making decisions based on branch existence
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Azure Login
         uses: azure/login@v1

.github/workflows/codeql-analysis.yml

@@ -43,6 +43,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v1

.github/workflows/deploy_tre_reusable.yml

@@ -83,6 +83,8 @@ jobs:
       - name: Checkout (default)
         if: ${{ inputs.prRepo == '' }} # if not running for a PR, checkout the default ref for the workflow run
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Checkout (PR)
         if: ${{ inputs.prRepo != '' }} # if running for a PR, checkout the PR commit
@@ -94,8 +96,6 @@ jobs:
 
       - name: Set up Docker BuildKit
         uses: docker/setup-buildx-action@v1
-        with:
-          persist-credentials: false
 
       - name: Login to Container Registry
         uses: docker/login-action@v1
@@ -313,6 +313,8 @@ jobs:
       - name: Checkout (default)
         if: ${{ inputs.prRepo == '' }} # if not running for a PR, checkout the default ref for the workflow run
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Checkout (PR)
         if: ${{ inputs.prRepo != '' }} # if running for a PR, checkout the PR commit

.github/workflows/e2e.yml

@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Run E2E Tests
         uses: ./.github/actions/devcontainer_run_command
@@ -44,6 +46,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Run E2E Tests (Extended)
         uses: ./.github/actions/devcontainer_run_command

.github/workflows/lets_encrypt.yml

@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@v1