Merge pull request #28 from ApolloAutomation/harden-checkout-persist-credentials

Add persist-credentials: false to all checkout steps

Author: TrevorSchirmer

.github/workflows/build.yml

@@ -65,6 +65,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Find .yaml Changes in Last PR Merge
         id: check
@@ -103,6 +104,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Read version from YAML file
         id: read_version
@@ -259,6 +262,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       # Download all firmware artifacts
       - name: Download all firmware artifacts

.github/workflows/minimal-pages.yml

@@ -23,7 +23,9 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
-        
+        with:
+          persist-credentials: false
+
       - name: Find and display all symlinks and hardlinks
         run: |
           echo "=== DETAILED LINK ANALYSIS ==="

.github/workflows/publish.yml

@@ -26,6 +26,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Read version from YAML file
         id: read_version
         run: |
@@ -71,6 +73,8 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Debug repository structure
         run: |
@@ -136,7 +140,9 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
-        
+        with:
+          persist-credentials: false
+
       - name: Debug link analysis
         run: |
           find . -type l -not -path "./.git/*" -ls | tee repo_symlinks.txt