Skip to content

ci: use persist-credentials: false throughout - #96

Merged
cpu merged 1 commit into
rustls:mainfrom
cpu:cpu-dr-zizmor
Dec 6, 2024
Merged

cpu merged 1 commit into
rustls:mainfrom
cpu:cpu-dr-zizmor

Conversation

@cpu

@cpu cpu commented Dec 6, 2024

Copy link
Copy Markdown
Member

We already do this in most of the other Rustls crates, and Zizmor 0.7.0 flags its absence in this repo. As mentioned in the description of this finding:

By default, using actions/checkout causes a credential to be persisted in the checked-out repo's .git/config, so that subsequent git operations can be authenticated.

Subsequent steps may accidentally publicly persist .git/config, e.g. by including it in a publicly accessible artifact via actions/upload-artifact.

However, even without this, persisting the credential in the .git/config is non-ideal unless actually needed.

We don't need it, so turn it off :-)

We already do this in most of the other Rustls crates, and Zizmor 0.7.0
flags[0] its absence in this repo.

[0]: https://woodruffw.github.io/zizmor/audits/#artipacked
@cpu cpu self-assigned this Dec 6, 2024
@cpu
cpu merged commit cd399ab into rustls:main Dec 6, 2024
@cpu
cpu deleted the cpu-dr-zizmor branch December 6, 2024 19:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants