From 46995c4a3074ef7c31ed4b419fd85bf9d7b5812a Mon Sep 17 00:00:00 2001 From: Joey Parrish Date: Tue, 17 Dec 2024 19:45:04 -0800 Subject: [PATCH] ci: Do not persist credentials after checkout See actions/checkout#485 and https://johnstawinski.com/2024/01/11/playing-with-fire-how-we-executed-a-critical-supply-chain-attack-on-pytorch/ In short, it is a terrible idea to persist even our default credentials after checkout. There's no call for that, so we will now set `persist-credentials: false` on all checkout actions. --- .github/workflows/release-please.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index b8cd518..e16173f 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -23,6 +23,7 @@ jobs: - uses: actions/checkout@v4 with: ref: ${{ github.event.after }} + persist-credentials: false if: ${{ steps.release.outputs.release_created }} - run: npm run build