4
94%
2.x: 94%

Ran 11 Mar 2026 03:26PM UTC

Files 9

Run time 0s

Badge

Embed ▾

Committed 11 Mar 2026 03:22PM UTC coverage: 93.058%. Remained the same

Job # 22960163769.4

Build Type

push

github

Committed by

web-flow

Commit Message

GH Actions: do not persist credentials (#363)

> By default, using `actions/checkout` causes a credential to be persisted in the checked-out repo's `.git/config`, so that subsequent `git` operations can be authenticated.
>
> Subsequent steps may accidentally publicly persist `.git/config`, e.g. by including it in a publicly accessible artifact via `actions/upload-artifact`.
>
> However, even without this, persisting the credential in the `.git/config` is non-ideal unless actually needed.
>
> **Remediation**
>
> Unless needed for `git` operations, `actions/checkout` should be used with `persist-credentials: false`.
>
> If the persisted credential is needed, it should be made explicit with `persist-credentials: true`.

This has now been addressed in all workflows.

Refs:
* https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/
* https://docs.zizmor.sh/audits/#artipacked

Co-authored-by: jrfnl <jrfnl@users.noreply.github.com>

Coverage Stats

1783 of 1916 relevant lines covered (93.06%)

36.68 hits per line

sirbrillig / phpcs-variable-analysis / 22960163769 / 4
94%
2.x: 94%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job php-8.5-phpcs-4.x-dev - 22960163769.4

sirbrillig / phpcs-variable-analysis / 22960163769 / 4 94% 2.x: 94%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job php-8.5-phpcs-4.x-dev - 22960163769.4

sirbrillig / phpcs-variable-analysis / 22960163769 / 4
94%
2.x: 94%

README BADGES
x