Skip to content

Commit 0c6508c

Browse files
opentelemetrybottraskxrmx
authored
ci: restrict checkout credential persistence (#5589)
* ci: disable checkout credential persistence * ci: preserve generated checkout options Assisted-by: GitHub Copilot * ci: authenticate workflow pushes explicitly Assisted-by: GitHub Copilot * ci: preserve credentials for workflow pushes * ci: preserve release branch push credentials --------- Co-authored-by: Trask Stalnaker <trask.stalnaker@gmail.com> Co-authored-by: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
1 parent 2e88971 commit 0c6508c

15 files changed

Lines changed: 945 additions & 4 deletions

‎.github/workflows/backport.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ jobs:
2525
with:
2626
# history is needed to run git cherry-pick below
2727
fetch-depth: 0
28+
# zizmor: ignore[artipacked] Credentials are required by the branch push below.
29+
persist-credentials: true
2830

2931
- name: Use CLA approved github bot
3032
run: .github/scripts/use-cla-approved-github-bot.sh

‎.github/workflows/benchmarks.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ jobs:
2323
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
2424
- name: Checkout Core Repo @ SHA - ${{ github.sha }}
2525
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26+
with:
27+
persist-credentials: false
2628
- name: Set up uv
2729
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
2830
- name: Run tox

‎.github/workflows/changelog.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ jobs:
2525
steps:
2626
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2727
with:
28+
persist-credentials: false
2829
fetch-depth: 0
2930

3031
- name: Fetch base branch

‎.github/workflows/check-links.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ jobs:
4040
- name: Checkout Repo
4141
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4242
with:
43+
persist-credentials: false
4344
fetch-depth: 0
4445

4546
- name: Get changed markdown files

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ jobs:
2626
steps:
2727
- name: Checkout repository
2828
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
29+
with:
30+
persist-credentials: false
2931

3032
# Initializes the CodeQL tools for scanning.
3133
- name: Initialize CodeQL

‎.github/workflows/fossa.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ jobs:
1313
runs-on: ubuntu-latest
1414
steps:
1515
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
16+
with:
17+
persist-credentials: false
1618

1719
- uses: fossas/fossa-action@ff70fe9fe17cbd2040648f1c45e8ec4e4884dcf3 # v1.9.0
1820
with:

‎.github/workflows/lint.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ jobs:
3131
steps:
3232
- name: Checkout repo @ SHA - ${{ github.sha }}
3333
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
34+
with:
35+
persist-credentials: false
3436

3537
- name: Set up Python 3.14
3638
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -50,6 +52,8 @@ jobs:
5052
steps:
5153
- name: Checkout repo @ SHA - ${{ github.sha }}
5254
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
55+
with:
56+
persist-credentials: false
5357

5458
- name: Set up Python 3.14
5559
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -69,6 +73,8 @@ jobs:
6973
steps:
7074
- name: Checkout repo @ SHA - ${{ github.sha }}
7175
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
76+
with:
77+
persist-credentials: false
7278

7379
- name: Set up Python 3.14
7480
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -88,6 +94,8 @@ jobs:
8894
steps:
8995
- name: Checkout repo @ SHA - ${{ github.sha }}
9096
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
97+
with:
98+
persist-credentials: false
9199

92100
- name: Set up Python 3.14
93101
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -107,6 +115,8 @@ jobs:
107115
steps:
108116
- name: Checkout repo @ SHA - ${{ github.sha }}
109117
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
118+
with:
119+
persist-credentials: false
110120

111121
- name: Set up Python 3.14
112122
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -126,6 +136,8 @@ jobs:
126136
steps:
127137
- name: Checkout repo @ SHA - ${{ github.sha }}
128138
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
139+
with:
140+
persist-credentials: false
129141

130142
- name: Set up Python 3.14
131143
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -145,6 +157,8 @@ jobs:
145157
steps:
146158
- name: Checkout repo @ SHA - ${{ github.sha }}
147159
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
160+
with:
161+
persist-credentials: false
148162

149163
- name: Set up Python 3.14
150164
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -164,6 +178,8 @@ jobs:
164178
steps:
165179
- name: Checkout repo @ SHA - ${{ github.sha }}
166180
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
181+
with:
182+
persist-credentials: false
167183

168184
- name: Set up Python 3.14
169185
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -183,6 +199,8 @@ jobs:
183199
steps:
184200
- name: Checkout repo @ SHA - ${{ github.sha }}
185201
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
202+
with:
203+
persist-credentials: false
186204

187205
- name: Set up Python 3.14
188206
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -202,6 +220,8 @@ jobs:
202220
steps:
203221
- name: Checkout repo @ SHA - ${{ github.sha }}
204222
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
223+
with:
224+
persist-credentials: false
205225

206226
- name: Set up Python 3.14
207227
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -221,6 +241,8 @@ jobs:
221241
steps:
222242
- name: Checkout repo @ SHA - ${{ github.sha }}
223243
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
244+
with:
245+
persist-credentials: false
224246

225247
- name: Set up Python 3.14
226248
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -240,6 +262,8 @@ jobs:
240262
steps:
241263
- name: Checkout repo @ SHA - ${{ github.sha }}
242264
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
265+
with:
266+
persist-credentials: false
243267

244268
- name: Set up Python 3.14
245269
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -259,6 +283,8 @@ jobs:
259283
steps:
260284
- name: Checkout repo @ SHA - ${{ github.sha }}
261285
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
286+
with:
287+
persist-credentials: false
262288

263289
- name: Set up Python 3.14
264290
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -278,6 +304,8 @@ jobs:
278304
steps:
279305
- name: Checkout repo @ SHA - ${{ github.sha }}
280306
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
307+
with:
308+
persist-credentials: false
281309

282310
- name: Set up Python 3.14
283311
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -297,6 +325,8 @@ jobs:
297325
steps:
298326
- name: Checkout repo @ SHA - ${{ github.sha }}
299327
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
328+
with:
329+
persist-credentials: false
300330

301331
- name: Set up Python 3.14
302332
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -316,6 +346,8 @@ jobs:
316346
steps:
317347
- name: Checkout repo @ SHA - ${{ github.sha }}
318348
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
349+
with:
350+
persist-credentials: false
319351

320352
- name: Set up Python 3.14
321353
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -335,6 +367,8 @@ jobs:
335367
steps:
336368
- name: Checkout repo @ SHA - ${{ github.sha }}
337369
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
370+
with:
371+
persist-credentials: false
338372

339373
- name: Set up Python 3.14
340374
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -354,6 +388,8 @@ jobs:
354388
steps:
355389
- name: Checkout repo @ SHA - ${{ github.sha }}
356390
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
391+
with:
392+
persist-credentials: false
357393

358394
- name: Set up Python 3.14
359395
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -373,6 +409,8 @@ jobs:
373409
steps:
374410
- name: Checkout repo @ SHA - ${{ github.sha }}
375411
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
412+
with:
413+
persist-credentials: false
376414

377415
- name: Set up Python 3.14
378416
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -392,6 +430,8 @@ jobs:
392430
steps:
393431
- name: Checkout repo @ SHA - ${{ github.sha }}
394432
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
433+
with:
434+
persist-credentials: false
395435

396436
- name: Set up Python 3.14
397437
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -411,6 +451,8 @@ jobs:
411451
steps:
412452
- name: Checkout repo @ SHA - ${{ github.sha }}
413453
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
454+
with:
455+
persist-credentials: false
414456

415457
- name: Set up Python 3.14
416458
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -430,6 +472,8 @@ jobs:
430472
steps:
431473
- name: Checkout repo @ SHA - ${{ github.sha }}
432474
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
475+
with:
476+
persist-credentials: false
433477

434478
- name: Set up Python 3.14
435479
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -449,6 +493,8 @@ jobs:
449493
steps:
450494
- name: Checkout repo @ SHA - ${{ github.sha }}
451495
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
496+
with:
497+
persist-credentials: false
452498

453499
- name: Set up Python 3.14
454500
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -468,6 +514,8 @@ jobs:
468514
steps:
469515
- name: Checkout repo @ SHA - ${{ github.sha }}
470516
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
517+
with:
518+
persist-credentials: false
471519

472520
- name: Set up Python 3.14
473521
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -487,6 +535,8 @@ jobs:
487535
steps:
488536
- name: Checkout repo @ SHA - ${{ github.sha }}
489537
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
538+
with:
539+
persist-credentials: false
490540

491541
- name: Set up Python 3.14
492542
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -506,6 +556,8 @@ jobs:
506556
steps:
507557
- name: Checkout repo @ SHA - ${{ github.sha }}
508558
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
559+
with:
560+
persist-credentials: false
509561

510562
- name: Set up Python 3.14
511563
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -525,6 +577,8 @@ jobs:
525577
steps:
526578
- name: Checkout repo @ SHA - ${{ github.sha }}
527579
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
580+
with:
581+
persist-credentials: false
528582

529583
- name: Set up Python 3.14
530584
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -544,6 +598,8 @@ jobs:
544598
steps:
545599
- name: Checkout repo @ SHA - ${{ github.sha }}
546600
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
601+
with:
602+
persist-credentials: false
547603

548604
- name: Set up Python 3.14
549605
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

0 commit comments

Comments
 (0)