From 57d141c7015a99a2b6b0175551b6ee74f75f6488 Mon Sep 17 00:00:00 2001
From: Jake Howard <jake.howard@torchbox.com>
Date: Mon, 9 Dec 2024 16:47:33 +0000
Subject: [PATCH] Don't persist credentials in CI
There's no vulnerability here, especially since the token explicitly only has read access anyway, but it's worth improving regardless.
---
.github/workflows/codeql-analysis.yml | 4 +++-
.github/workflows/test.yml | 15 +++++++++++++++
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 5c08d27847..596b9d6b70 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -24,7 +24,9 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v2
+ uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Initialize CodeQL
uses: github/codeql-action/init@v1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 315649f760..48263efb0a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -59,6 +59,8 @@ jobs:
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Set up Python ${{ matrix.python }}
uses: actions/setup-python@v5
with:
@@ -124,6 +126,8 @@ jobs:
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Set up Python ${{ matrix.python }}
uses: actions/setup-python@v5
with:
@@ -216,6 +220,8 @@ jobs:
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Set up Python ${{ matrix.python }}
uses: actions/setup-python@v5
with:
@@ -269,6 +275,8 @@ jobs:
node port: 9300
discovery type: 'single-node'
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Set up Python ${{ matrix.python }}
uses: actions/setup-python@v5
with:
@@ -324,6 +332,9 @@ jobs:
with:
stack-version: 7.6.1
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
+
- name: Set up Python ${{ matrix.python }}
uses: actions/setup-python@v5
with:
@@ -374,6 +385,8 @@ jobs:
with:
opensearch-version: 2
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Set up Python ${{ matrix.python }}
uses: actions/setup-python@v5
with:
@@ -411,6 +424,8 @@ jobs:
steps:
- name: Check out the repo
uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Set up Python
uses: actions/setup-python@v5