mirror of
https://github.com/suitenumerique/meet.git
synced 2026-10-06 21:42:06 +00:00
lebaudantoine
03db669e51
By default, `actions/checkout` saves the job's auth token
(`GITHUB_TOKEN` or the provided PAT) in the local git config so
later steps can run authenticated git commands. That token then
stays on disk for the rest of the job, where it can leak:
* If an artifact upload includes the checkout directory, the token
is packaged with it and anyone with artifact access can extract
it. On public repos that is anyone, and the token can be used
while the job is still running ("ArtiPACKED", flagged by
`zizmor` as `artipacked`).
* Any later step, third-party action, or build dependency can read
the token from the git config, which widens the impact of a
supply-chain compromise.
None of our workflows need authenticated git after checkout, so
disable credential persistence. If a step needs to push in