Skip to content

Commit 4a53aff

Browse files
MauricioFauthMauricioFauth
authored
Merge pull request #20340 from MauricioFauth/zizmor-master
Do not persist Git credentials in actions workflows
2 parents b530496 + f65adbd commit 4a53aff

10 files changed

Lines changed: 31 additions & 0 deletions

‎.github/workflows/daily-snapshots.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ jobs:
2828
uses: actions/checkout@v6
2929
with:
3030
ref: ${{ matrix.branch }}
31+
persist-credentials: false
3132

3233
- name: Install Gettext
3334
run: sudo apt-get install -y gettext

‎.github/workflows/frontend-tests.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ jobs:
2424
steps:
2525
- name: Checkout code
2626
uses: actions/checkout@v6
27+
with:
28+
persist-credentials: false
2729

2830
- name: Set up Node
2931
uses: actions/setup-node@v6
@@ -43,6 +45,8 @@ jobs:
4345
steps:
4446
- name: Checkout code
4547
uses: actions/checkout@v6
48+
with:
49+
persist-credentials: false
4650

4751
- name: Set up Node
4852
uses: actions/setup-node@v6
@@ -62,6 +66,8 @@ jobs:
6266
steps:
6367
- name: Checkout code
6468
uses: actions/checkout@v6
69+
with:
70+
persist-credentials: false
6571

6672
- name: Set up Node
6773
uses: actions/setup-node@v6

‎.github/workflows/lint-and-analyse-php.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ jobs:
2020
steps:
2121
- name: Checkout code
2222
uses: actions/checkout@v6
23+
with:
24+
persist-credentials: false
2325

2426
- name: Set up PHP ${{ matrix.php-version }}
2527
uses: shivammathur/setup-php@v2
@@ -68,6 +70,8 @@ jobs:
6870
steps:
6971
- name: Checkout code
7072
uses: actions/checkout@v6
73+
with:
74+
persist-credentials: false
7175

7276
- name: Set up PHP ${{ matrix.php-version }}
7377
uses: shivammathur/setup-php@v2

‎.github/workflows/lint-docs.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ jobs:
1717
steps:
1818
- name: Checkout code
1919
uses: actions/checkout@v6
20+
with:
21+
persist-credentials: false
2022

2123
- name: Lint phpdoc blocks
2224
uses: sudo-bot/action-doctum@v5

‎.github/workflows/mutation-tests.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,14 @@ jobs:
3737
uses: actions/checkout@v6
3838
with:
3939
fetch-depth: 2
40+
persist-credentials: false
4041

4142
- name: Checkout base ref code
4243
if: github.event_name == 'pull_request'
4344
uses: actions/checkout@v6
4445
with:
4546
ref: ${{ github.base_ref }}
47+
persist-credentials: false
4648

4749
- name: Install Gettext
4850
run: sudo apt-get install -y gettext

‎.github/workflows/other-tools.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ jobs:
1717
steps:
1818
- name: Checkout code
1919
uses: actions/checkout@v6
20+
with:
21+
persist-credentials: false
2022

2123
- name: Install Sphinx for the documentation build
2224
run: |
@@ -34,6 +36,8 @@ jobs:
3436
steps:
3537
- name: Checkout code
3638
uses: actions/checkout@v6
39+
with:
40+
persist-credentials: false
3741

3842
- name: Install gettext
3943
run: sudo apt-get install -y gettext

‎.github/workflows/shellcheck.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ jobs:
1818
steps:
1919
- name: Checkout
2020
uses: actions/checkout@v6
21+
with:
22+
persist-credentials: false
2123

2224
- name: Run ShellCheck
2325
uses: reviewdog/action-shellcheck@v1

‎.github/workflows/test-selenium.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ jobs:
2525
steps:
2626
- name: Checkout code
2727
uses: actions/checkout@v6
28+
with:
29+
persist-credentials: false
2830
- id: tests-list
2931
name: Send test names to outputs
3032
run: |
@@ -79,6 +81,8 @@ jobs:
7981
steps:
8082
- name: Checkout code
8183
uses: actions/checkout@v6
84+
with:
85+
persist-credentials: false
8286

8387
- name: Install gettext
8488
run: sudo apt-get update && sudo apt-get install -y gettext

‎.github/workflows/tests.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ jobs:
2929
steps:
3030
- name: Checkout code
3131
uses: actions/checkout@v6
32+
with:
33+
persist-credentials: false
3234

3335
- name: Write script
3436
# tcpdf allowed memory exhausted needs the memory_limit workaround
@@ -82,6 +84,7 @@ jobs:
8284
with:
8385
# Fetch some commits for Scrutinizer coverage upload
8486
fetch-depth: 15
87+
persist-credentials: false
8588

8689
- name: Install gettext
8790
run: sudo apt-get install -y gettext
@@ -143,6 +146,7 @@ jobs:
143146
with:
144147
# Fetch some commits for Scrutinizer coverage upload
145148
fetch-depth: 15
149+
persist-credentials: false
146150

147151
- name: Install gettext
148152
run: sudo apt-get install -y gettext

‎.github/workflows/update-po.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ jobs:
2222
steps:
2323
- name: Checkout code
2424
uses: actions/checkout@v6
25+
with:
26+
persist-credentials: true
2527

2628
- name: Install Gettext
2729
run: |

0 commit comments

Comments
 (0)