From 26ddb68f93c6a9e1415202563fdd293d50b8a6b6 Mon Sep 17 00:00:00 2001 From: Andrei Gherzan Date: Sun, 18 Oct 2026 19:41:35 +0100 Subject: [PATCH] ci: don't persist the checkout token Nothing after checkout should need the GITHUB_TOKEN so persisting would only be an extra risk. Signed-off-by: Andrei Gherzan --- .github/workflows/compliance.yml | 2 ++ .github/workflows/yocto-builds.yml | 1 + .github/workflows/yocto-layer.yml | 1 + 3 files changed, 4 insertions(+) diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml index cc66fa0..a508b0d 100644 --- a/.github/workflows/compliance.yml +++ b/.github/workflows/compliance.yml @@ -16,6 +16,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Build a temporary DCO image uses: ./.github/actions/docker-build with: @@ -44,6 +45,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Do reuse check continue-on-error: true uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0 diff --git a/.github/workflows/yocto-builds.yml b/.github/workflows/yocto-builds.yml index ac40ad6..dbff9f5 100644 --- a/.github/workflows/yocto-builds.yml +++ b/.github/workflows/yocto-builds.yml @@ -35,6 +35,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Check for Yocto relevant changes id: changed-files-specific uses: ./.github/actions/changed-files diff --git a/.github/workflows/yocto-layer.yml b/.github/workflows/yocto-layer.yml index d7805fe..673aeea 100644 --- a/.github/workflows/yocto-layer.yml +++ b/.github/workflows/yocto-layer.yml @@ -18,6 +18,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Check for Yocto relevant changes id: changed-files-specific uses: ./.github/actions/changed-files