From 51f4075fd6cf60fd1eee2650da89a83c916b6ea1 Mon Sep 17 00:00:00 2001 From: ekklesia Date: Tue, 28 Jul 2026 19:49:12 -0500 Subject: [PATCH] ci: stop persisting the job token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `actions/checkout` defaults to `persist-credentials: true`, which writes the job token into `.git/config` and leaves it there for every later step. Nothing in this workflow pushes, so the credential has no use after checkout — but a pull request can edit this file, and any step it adds runs in the same workspace. All three jobs now check out with `persist-credentials: false`. The rest of the workflow's posture is unchanged and was re-verified: top-level `permissions: contents: read`, both actions pinned by full commit SHA, `pnpm install --frozen-lockfile`, no `pull_request_target`, and no secrets referenced anywhere. This is the one property from the Pass 5 runner-isolation requirements that is repository-local and statically verifiable. The rest — whether pull-request jobs run on a disposable guest, what Docker daemon they reach, and which runners this repository can select — depends on the actual Gitea and runner hosts and is not claimed here. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c3b3d39..c9d8f73 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,6 +20,11 @@ jobs: steps: - name: Check out repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + # `actions/checkout` defaults to leaving the job token in `.git/config`, where any later + # step — including one a pull request added to this file — could read or reuse it. Nothing + # in this workflow pushes, so the credential is never needed after checkout. + persist-credentials: false - name: Set up Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 @@ -44,6 +49,11 @@ jobs: steps: - name: Check out repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + # `actions/checkout` defaults to leaving the job token in `.git/config`, where any later + # step — including one a pull request added to this file — could read or reuse it. Nothing + # in this workflow pushes, so the credential is never needed after checkout. + persist-credentials: false - name: Exercise PostgreSQL and S3 infrastructure run: bash scripts/smoke-infrastructure.sh @@ -55,6 +65,11 @@ jobs: steps: - name: Check out repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + # `actions/checkout` defaults to leaving the job token in `.git/config`, where any later + # step — including one a pull request added to this file — could read or reuse it. Nothing + # in this workflow pushes, so the credential is never needed after checkout. + persist-credentials: false - name: Set up Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0