From e07df6da53a0ae5c07383546b7219577a68610cd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Aug 2026 14:50:12 +0200 Subject: zizmor: set persist-credentials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit per zizmor, actions/checkout should be followed by removal of credentials that may have been saved to disk. Doing so fixes lots of whining such as: ``` warning[artipacked]: credential persistence through GitHub Actions artifacts --> ./.github/workflows/android.yml:27:9 | 27 | - name: "Checkout repository" | _________^ 28 | | uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |________________________________________________________________________________^ does not set persist-credentials: false | = note: audit confidence → Low = note: this finding has an auto-fix ``` --- .github/workflows/linux.yml | 4 ++++ 1 file changed, 4 insertions(+) (limited to '.github/workflows/linux.yml') diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 4fbe987..a2a85e7 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -48,6 +48,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | @@ -100,6 +102,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | -- cgit v1.2.3-55-g6feb