ci: disable persist-credentials on checkouts that don't push#1463
Merged
Conversation
Stops GITHUB_TOKEN from being written into .git/config on jobs that never run authenticated git operations against this repo. Clears CodeRabbit's repeated finding and matches OpenSSF Scorecard guidance. release-rs and update-flake are left alone because release-plz and DeterminateSystems/update-flake-lock both rely on the persisted credential to push.
Contributor
|
Warning Review limit reached
Your plan currently allows 4 reviews/hour. Refill in 4 minutes and 34 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
kixelated
pushed a commit
that referenced
this pull request
May 23, 2026
Brings in the dry-run + persist-credentials + Determinate-Nix opt-out changes from main (PRs #1463, #1464, #1465). Resolves the recurring conflict in moq-relay.yml by keeping this branch's Nix-based rewrite and layering the new patterns on top. Extends the dry-run pattern to the four workflows this branch adds plus moq-gst (which #1464 didn't cover): - moq-relay, moq-cli, moq-clock, moq-token-cli, moq-gst now trigger on pull_request when the workflow itself, its build script, the nix derivation, or the flake changes. The build job parses the version from Cargo.toml on PRs (release.sh parse-version expects a tag). The release job is gated on github.event_name == 'push'. - release-brew.yml gains a dry-run job that, on PRs touching the workflow or any formula template, renders every template against synthetic tarballs and runs ruby -c on the output. The publish job is gated to workflow_run events only. Also adds persist-credentials: false to all checkouts that don't push, and `with: { determinate: false }` to nix-installer-action, matching the main-branch convention. https://claude.ai/code/session_015J5tVAQ7ESjBhnzdeXfhgX
kixelated
added a commit
that referenced
this pull request
May 23, 2026
…ish)
* packaging/moq-relay/moq-relay.service: ExecStart was passing --config
but moq-relay's clap parser exposes the TOML path as --file (see
rs/moq-relay/src/config.rs). The service would have failed to start
on every install.
* infra/apt/src/worker.ts: stop applying immutable Cache-Control to all
.gpg files. The only static one is moq-archive-keyring.gpg; Release.gpg
is rewritten every release and was getting pinned at the edge.
* infra/rpm/publish.sh: reject .rpms whose arch isn't in ARCHES (or
noarch). Previously an unsupported arch silently produced a directory
that never got indexed or signed.
* infra/{apt,rpm}/publish.sh: move GNUPGHOME removal into the EXIT trap
so key material is wiped even when signing fails.
* .github/workflows: set persist-credentials: false on every checkout in
the workflows this PR introduced (moq-cli, moq-token-cli, apt-repo,
rpm-repo, and the new moq-gst package-deb / package-rpm jobs). Brings
them in line with the convention from #1463.
* packaging/moq-relay/relay.toml: the comment claimed anonymous publish
was anon/** only; config also grants demo/viewer. Fixed.
* rs/justfile: drop the hardcoded amd64 fallback when dpkg isn't
installed. Map from uname -m so `just rs package` produces the right
arch label on arm64 hosts.
* rs/moq-gst/package.sh: validate that flag values are present before
reading $2, so a missing value produces a usage error instead of an
unbound-variable crash.
* doc/setup/linux.md: create /var/lib/moq-relay before the cp step (it
doesn't exist until the service starts and creates its StateDirectory)
and rename the misleading "verify a .deb directly" heading.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
By default
actions/checkoutwritesGITHUB_TOKENinto.git/configso subsequentgitcommands authenticate transparently. Any later step in the same job can read that token, which is why OpenSSF Scorecard / CIS GitHub recommend settingpersist-credentials: falsewhenever the workflow doesn't actually need authenticated git operations. CodeRabbit has been flagging this on every PR.This adds
persist-credentials: falseto 18 checkout steps across 8 workflows. The most security-relevant one is check.yml since it runs onpull_requestagainst untrusted code; the rest are defensive hardening on release workflows that only push to crates.io / npm / PyPI / Cachix / Maven Central / docker.io, not back to this repo.Two checkouts are intentionally left as-is because the persisted credential is load-bearing:
release-plzrunsgit pushusing the credential the checkout persisted (it passestoken:explicitly).DeterminateSystems/update-flake-lockpushes a branch and opens the PR using the persisted credential.Test plan
check.ymlstill passes on this PR (it's the only workflow that runs onpull_request)persist-credentialsfindingsgit push,git commit, orgit tagagainst this repo (theghCLI calls in .github/scripts/release.sh useGH_TOKENfrom step env, not the persisted credential)🤖 Generated with Claude Code