Repository navigation
security(ci): disable persisted checkout credentials in read-only workflows #490
Description
Why
Every workflow checkout currently leaves the GitHub token in the local Git credential configuration. These jobs only read and test code, so later build steps do not need reusable Git credentials.
Scope
Set checkout credential persistence off in all workflows.
Acceptance criteria
- Add
persist-credentials: falseto everyactions/checkoutstep. - Keep checkout depth and all existing job behavior unchanged.
- Add a short comment explaining that downstream steps do not push.
- Verify each workflow still reaches its first test or documentation check.
Do not add replacement tokens or credentials.
Activity
emirykl commentedon Oct 21, 2026
@emirykl has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @emirykl to this issue.
abojeEdwin commentedon Oct 21, 2026
@abojeEdwin has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @abojeEdwin to this issue.
drips-wave commentedon Oct 21, 2026
Congratulations, @abojeEdwin! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @abojeEdwin: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
security(ci): disable persisted checkout credentials in read-only wor…
security(ci): cover all 7 checkout steps and add regression guard
grantfox-oss commentedon Oct 27, 2026
🎉 This issue has been marked as completed on GrantFox!
@abojeEdwin's PR #497 was approved and merged by @karagozemin.
🏆 @abojeEdwin: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (573 total points). Track your full progress on GrantFox.
👏 Great work, @abojeEdwin! Keep contributing to Sub-Rosa-Issue.