CI: disable persist-credentials for actions/checkout

It is a possible security issue. We do not want to persist credentials in the repo and thus exposing those to further steps. References: actions/checkout#485 (comment) azat/chdig#67
traveltime-dev · Oct 25, 2024 · a7b6f20 · a7b6f20
1 parent a84cbb6
commit a7b6f20
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -24,6 +24,8 @@ jobs:
           - "3.12"
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
         with:

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -13,6 +13,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v4
         with: