From a83c33b21cad4901db3609f97e4c0b0ec14350b9 Mon Sep 17 00:00:00 2001
From: Tamir Kamara <26870601+tamirkamara@users.noreply.github.com>
Date: Sun, 27 Feb 2022 10:58:02 +0200
Subject: [PATCH] checkout without persisting credentials (#1374)

---
 .github/actions/devcontainer_run_command/action.yml | 2 ++
 .github/workflows/build_docker_images.yml           | 2 ++
 .github/workflows/build_docs.yml                    | 2 ++
 .github/workflows/clean_validation_envs.yml         | 1 +
 .github/workflows/codeql-analysis.yml               | 2 ++
 .github/workflows/deploy_tre_reusable.yml           | 6 ++++--
 .github/workflows/e2e.yml                           | 4 ++++
 .github/workflows/lets_encrypt.yml                  | 2 ++
 8 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/.github/actions/devcontainer_run_command/action.yml b/.github/actions/devcontainer_run_command/action.yml
index 2072aa1d27..03b1162a04 100644
--- a/.github/actions/devcontainer_run_command/action.yml
+++ b/.github/actions/devcontainer_run_command/action.yml
@@ -121,6 +121,8 @@ runs:
   steps:
     - name: Checkout
       uses: actions/checkout@v2
+      with:
+        persist-credentials: false
 
     - name: Login to Container Registry
       uses: docker/login-action@v1
diff --git a/.github/workflows/build_docker_images.yml b/.github/workflows/build_docker_images.yml
index 12b64e1282..a26c21483c 100644
--- a/.github/workflows/build_docker_images.yml
+++ b/.github/workflows/build_docker_images.yml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Filter changes
         uses: dorny/paths-filter@v2
diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml
index fac96b4efc..9583e820e2 100644
--- a/.github/workflows/build_docs.yml
+++ b/.github/workflows/build_docs.yml
@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v2
         with:
           python-version: 3.x
diff --git a/.github/workflows/clean_validation_envs.yml b/.github/workflows/clean_validation_envs.yml
index 15614b3ef0..60f8e3f02a 100644
--- a/.github/workflows/clean_validation_envs.yml
+++ b/.github/workflows/clean_validation_envs.yml
@@ -18,6 +18,7 @@ jobs:
         with:
           # This is CRITICAL since we're making decisions based on branch existence
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Azure Login
         uses: azure/login@v1
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 48ed06087d..df6ae864dd 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -43,6 +43,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v1
diff --git a/.github/workflows/deploy_tre_reusable.yml b/.github/workflows/deploy_tre_reusable.yml
index 09a53ac3e6..8c53ce9ef3 100644
--- a/.github/workflows/deploy_tre_reusable.yml
+++ b/.github/workflows/deploy_tre_reusable.yml
@@ -83,6 +83,8 @@ jobs:
       - name: Checkout (default)
         if: ${{ inputs.prRepo == '' }} # if not running for a PR, checkout the default ref for the workflow run
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Checkout (PR)
         if: ${{ inputs.prRepo != '' }} # if running for a PR, checkout the PR commit
@@ -94,8 +96,6 @@ jobs:
 
       - name: Set up Docker BuildKit
         uses: docker/setup-buildx-action@v1
-        with:
-          persist-credentials: false
 
       - name: Login to Container Registry
         uses: docker/login-action@v1
@@ -313,6 +313,8 @@ jobs:
       - name: Checkout (default)
         if: ${{ inputs.prRepo == '' }} # if not running for a PR, checkout the default ref for the workflow run
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Checkout (PR)
         if: ${{ inputs.prRepo != '' }} # if running for a PR, checkout the PR commit
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 20bdcf3b44..b3e03c11fd 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Run E2E Tests
         uses: ./.github/actions/devcontainer_run_command
@@ -44,6 +46,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Run E2E Tests (Extended)
         uses: ./.github/actions/devcontainer_run_command
diff --git a/.github/workflows/lets_encrypt.yml b/.github/workflows/lets_encrypt.yml
index f97f4973de..a7070d44cc 100644
--- a/.github/workflows/lets_encrypt.yml
+++ b/.github/workflows/lets_encrypt.yml
@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@v1