Do not persist credentials on GH Actions #4435
Conversation
I ran a GH Actions safety checker, which suggested that the "persist-credentials" option should be set to "false". The rationale: https://woodruffw.github.io/zizmor/audits/#artipacked. It is not a big issue for us, as we don't upload artifacts from GH Actions, but using this option should add a bit of safety anyway.
|
elasticsearch_and_cassandra_27 / elasticsearch_and_cassandra_mnesia / 7241910 small_tests_26 / small_tests / 7241910 small_tests_27 / small_tests / 7241910 small_tests_27_arm64 / small_tests / 7241910 ldap_mnesia_26 / ldap_mnesia / 7241910 dynamic_domains_mysql_redis_27 / mysql_redis / 7241910 dynamic_domains_pgsql_mnesia_26 / pgsql_mnesia / 7241910 ldap_mnesia_27 / ldap_mnesia / 7241910 dynamic_domains_mssql_mnesia_27 / odbc_mssql_mnesia / 7241910 pgsql_cets_27 / pgsql_cets / 7241910 internal_mnesia_27 / internal_mnesia / 7241910 dynamic_domains_pgsql_mnesia_27 / pgsql_mnesia / 7241910 mysql_redis_27 / mysql_redis / 7241910 pgsql_mnesia_27 / pgsql_mnesia / 7241910 cockroachdb_cets_27 / cockroachdb_cets / 7241910 pgsql_mnesia_26 / pgsql_mnesia / 7241910 mssql_mnesia_27 / odbc_mssql_mnesia / 7241910 |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #4435 +/- ##
==========================================
+ Coverage 85.33% 85.36% +0.03%
==========================================
Files 549 549
Lines 33863 33863
==========================================
+ Hits 28896 28907 +11
+ Misses 4967 4956 -11 ☔ View full report in Codecov by Sentry. |
I ran a GH Actions safety checker called Zizmor, which suggested that the "persist-credentials" option should be set to "false", so that git auth tokens cannot be leaked. The full rationale: https://woodruffw.github.io/zizmor/audits/#artipacked. It is not a big issue for us, as we don't upload artifacts from GH Actions, but using this option should add a bit of safety anyway.
Manually run GH Actions to see if the change doesn't break anything: https://github.com/esl/MongooseIM/actions/runs/12299291228