From 3a2378d3b8d3a33f7202eea7d2cc432d837d5158 Mon Sep 17 00:00:00 2001
From: Joey Parrish <joeyparrish@users.noreply.github.com>
Date: Wed, 18 Dec 2024 02:12:34 -0800
Subject: [PATCH] ci: Do not persist credentials after checkout (#112)

See actions/checkout#485 and
https://johnstawinski.com/2024/01/11/playing-with-fire-how-we-executed-a-critical-supply-chain-attack-on-pytorch/

In short, it is a terrible idea to persist even our default credentials
after checkout. There's no call for that, so we will now set
`persist-credentials: false` on all checkout actions.
---
 .github/workflows/release-please.yaml | 1 +
 .github/workflows/test.yaml           | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index 23206a7..627ae8f 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -24,6 +24,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: refs/tags/${{ steps.release.outputs.tag_name }}
+          persist-credentials: false
         if: steps.release.outputs.releases_created
 
       - name: Setup Node.js
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index cd8c991..e0eb367 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -29,6 +29,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ github.ref }}
+          persist-credentials: false
 
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4