Disable git credential persistence on checkouts - #754
Merged
bschwedler merged 1 commit intoAug 17, 2026
Conversation
Fourteen actions/checkout steps across the shared reusable workflows relied on the default persist-credentials: true, which writes the job token into the workspace .git/config. zizmor's artipacked audit flags this as a credential-exfiltration risk: if a later step uploads the workspace (including .git) as an artifact, the token leaks into a downloadable, retained location. None of these jobs run an authenticated git operation after checkout -- registry logins carry their own credentials, bakery reads the workspace read-only, and gh release / gh pr use the GH_TOKEN env var rather than git config. Setting persist-credentials: false therefore removes the token with no behavior change and resolves the finding at its source instead of suppressing it. The two checkouts that genuinely need the persisted credential -- product-release (git push and PR creation with an App token) and docs (gh-pages publish) -- keep their exemptions, now the only entries in the artipacked ignore list. Neither uploads .git as an artifact, so no leak path remains. This also drops the stale bakery-build-native.yml line-number exemptions, letting the zizmor pre-commit hook report no findings.
bschwedler
force-pushed
the
fix/artipacked-persist-credentials
branch
from
August 17, 2026 20:14
f9a516e to
d992faa
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets
persist-credentials: falseon the checkouts whose jobs run no authenticated git operation afterward, so the checkout token isn't persisted where later steps don't need it. The two checkouts that do push (product-release, docs) keep it and remain the onlyartipackedexemptions.