From e07df6da53a0ae5c07383546b7219577a68610cd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Aug 2026 14:50:12 +0200 Subject: zizmor: set persist-credentials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit per zizmor, actions/checkout should be followed by removal of credentials that may have been saved to disk. Doing so fixes lots of whining such as: ``` warning[artipacked]: credential persistence through GitHub Actions artifacts --> ./.github/workflows/android.yml:27:9 | 27 | - name: "Checkout repository" | _________^ 28 | | uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |________________________________________________________________________________^ does not set persist-credentials: false | = note: audit confidence → Low = note: this finding has an auto-fix ``` --- .github/workflows/android.yml | 2 ++ .github/workflows/cmake-config.yml | 2 ++ .github/workflows/coverity.yml | 2 ++ .github/workflows/emscripten.yml | 4 ++++ .github/workflows/fedora-rawhide.yml | 2 ++ .github/workflows/freebsd.yml | 4 ++++ .github/workflows/linux.yml | 4 ++++ .github/workflows/macos.yml | 2 ++ .github/workflows/rust-openssl.yml | 2 ++ .github/workflows/solaris.yml | 2 ++ .github/workflows/windows.yml | 2 ++ 11 files changed, 28 insertions(+) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index a2faa94..d9d3b36 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -26,6 +26,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install build dependencies" run: | diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 5b57b78..493242d 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -25,6 +25,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup Windows dependencies" if: runner.os == 'Windows' diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index f00e2a2..33aba2e 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -23,6 +23,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install dependencies" run: | diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 914446b..ba0eb02 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -21,6 +21,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | @@ -55,6 +57,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index c3dd8a8..4ae9158 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -24,6 +24,8 @@ jobs: image: fedora:rawhide@sha256:0c1f63ed8fb818fad16cf6ae091598c410a21d2e1a9adf183beb93189299bfba steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk perl-IO-Socket-SSL diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index b0f8390..d457941 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -23,6 +23,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup" run: | @@ -51,6 +53,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup" run: | diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 4fbe987..a2a85e7 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -48,6 +48,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | @@ -100,6 +102,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index c619b17..1aabcd8 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -34,6 +34,8 @@ jobs: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 37d377f..600d15a 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -20,6 +20,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Build LibreSSL" run: | diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 0e50f5f..ddaca56 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -20,6 +20,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup" run: | diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 908e081..7199214 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -34,6 +34,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup MSYS2" id: msys2 -- cgit v1.2.3-55-g6feb