Skip to content

chore: ci bump (fixes #1168) #1259

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mirkosalvato1-ctrl wants to merge 1 commit into
base: main
Choose a base branch
from
+3 −3
Open

chore: ci bump (fixes #1168) #1259

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/JSONchecker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow checkout usage =="
rg -n "actions/checkout|persist-credentials|persist_credentials|git " .github/workflows || true

echo "== relevant workflow excerpts =="
for f in .github/workflows/JSONchecker.yml .github/workflows/greetings.yml .github/workflows/issue-reminder.yml; do
  if [ -f "$f" ]; then
    echo "-- $f --"
    nl -ba "$f" | sed -n '1,140p'
  else
    echo "missing: $f"
  fi
done

echo "== local commit check for YAML syntax =="
python3 - <<'PY'
import glob, re
for path in sorted(glob.glob(".github/workflows/*.yml")):
    text = open(path, encoding="utf-8").read()
    print(f"{path}: lines={text.count(chr(10))+1}, checkout_count={text.count('actions/checkout')}, persist_count={text.count('persist-credentials')+text.count('persist_credentials')}")
PY

Repository: codeaashu/DevDisplay

Length of output: 516

🌐 Web query:

actions/checkout v4 persist-credentials defaults GitHub token local git configuration

💡 Result:

In actions/checkout@v4, the persist-credentials input defaults to true [1][2][3]. When set to true (default), the action configures the GITHUB_TOKEN (or the provided personal access token/SSH key) in the local git configuration [2][4]. Specifically, it writes an http.{url}.extraheader setting containing an authorization header directly into the local .git/config file [4][5]. This persistence allows subsequent steps in the same workflow job to perform authenticated git commands (such as pushing commits or fetching submodules) without needing to manually re-authenticate [2][5]. When persist-credentials is set to false, the action skips this configuration, which prevents these credentials from being written to the .git/config file [4][5]. This is often recommended as a security best practice to minimize the risk of credential leakage (e.g., if the repository workspace, including the .git directory, is accidentally uploaded as a job artifact) [6][5]. Note that if persist-credentials is left at its default of true, the persisted git configuration can take precedence over other authentication methods, such as gh auth setup-git [4]. If you do not require subsequent steps to have authenticated git access, setting persist-credentials: false is the recommended approach to opt out [2][4][5].

Citations:

Disable persisted checkout credentials across all workflows.

actions/checkout@v4 persists the GitHub token in local Git config by default. Set persist-credentials: false at each checkout unless the job explicitly needs authenticated Git operations:

  • .github/workflows/JSONchecker.yml#L13-L13
  • .github/workflows/greetings.yml#L16-L16
  • .github/workflows/issue-reminder.yml#L11-L11
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 3 files
  • .github/workflows/JSONchecker.yml#L13-L13 (this comment)
  • .github/workflows/greetings.yml#L16-L16
  • .github/workflows/issue-reminder.yml#L11-L11
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/JSONchecker.yml at line 13, Disable persisted checkout
credentials for every listed checkout step by setting persist-credentials to
false in .github/workflows/JSONchecker.yml lines 13-13,
.github/workflows/greetings.yml lines 16-16, and
.github/workflows/issue-reminder.yml lines 11-11; no job explicitly requires
authenticated Git operations.

Source: Linters/SAST tools

- name: json-syntax-check
uses: limitusus/json-syntax-check@v2
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/greetings.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
welcome:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v1
- uses: actions/checkout@v4
- uses: EddieHubCommunity/gh-action-community/src/welcome@main
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/issue-reminder.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v2
uses: actions/checkout@v4

- name: Run script
uses: actions/github-script@v4
Expand Down
Loading