php-parallel-lint / PHP-Console-Highlighter

100%

LAST BUILD ON BRANCH master

branch: master

CHANGE BRANCH

x

Reset

• master
• coveralls
• dependabot/github_actions/action-runners-0937e01b9e
• dependabot/github_actions/action-runners-73dc52d6a4
• dependabot/github_actions/action-runners-e6ee9d7de3
• dependabot/github_actions/actions/checkout-4
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6.0.0
• dependabot/github_actions/coverallsapp/github-action-2
• dependabot/github_actions/ramsey/composer-install-3
• feature/README-move-badges-up
• feature/add-dependabot-config-for-ghactions
• feature/changelog-1.0.1
• feature/changelog-minor-touchup
• feature/composer-credit-contributors
• feature/dependabot-every-two-weeks
• feature/fix-test-runtime-deprecations-php-8.5
• feature/ghactions-cache-busting
• feature/ghactions-do-not-persist-credentials
• feature/ghactions-dont-use-set-output
• feature/ghactions-harden-cs-steps
• feature/ghactions-jobs-should-have-name
• feature/ghactions-pin-action-runners
• feature/ghactions-show-startup-errors
• feature/ghactions-switch-to-coveralls-reporter
• feature/ghactions-tweak-php-versions
• feature/ghactions-update
• feature/ghactions-update-for-php-8.4-release
• feature/ghactions-update-for-php-8.5-release
• feature/ghactions-update-various-actions
• feature/ghactions-various-minor-tweaks
• feature/tests-compatibility-with-phpunit-10

Build # 21345727131

Build Type

push

github

Committed by jrfnl

Commit Message

GH Actions: do not persist credentials

> By default, using `actions/checkout` causes a credential to be persisted in the checked-out repo's `.git/config`, so that subsequent `git` operations can be authenticated.
>
> Subsequent steps may accidentally publicly persist `.git/config`, e.g. by including it in a publicly accessible artifact via `actions/upload-artifact`.
>
> However, even without this, persisting the credential in the `.git/config` is non-ideal unless actually needed.
>
> **Remediation**
>
> Unless needed for `git` operations, `actions/checkout` should be used with `persist-credentials: false`.
>
> If the persisted credential is needed, it should be made explicit with `persist-credentials: true`.

This has now been addressed in all workflows.

Refs:
* https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/
* https://docs.zizmor.sh/audits/#artipacked

Run Details

119 of 119 relevant lines covered (100.0%)

32.1 hits per line