ci: don't bake the checkout token into shipped images - #77
Merged
Conversation
actions/checkout defaults to persist-credentials: true, which writes the job's short-lived GitHub token into .git/config as `http.https://github.com/.extraheader`. box-turnkey.nix bakes the working tree (self.outPath, including .git) into the image at /etc/nixos-repo, so that dead token ships in every installer/appliance image and lands on installed boxes. `git pull` there then sends the expired token, GitHub returns 401, and git prompts for a username (a fresh `git clone` has no such header and works anonymously). Set persist-credentials: false on the two checkouts whose tree is baked (test.yml Images, release.yml build). The repo is public, so the box's `git pull` works anonymously; the .git and origin are preserved. No workflow pushes via git, and the release uses GITHUB_TOKEN through action-gh-release, so nothing else relies on the persisted credential.
phorcys420
marked this pull request as ready for review
August 24, 2026 22:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Stop baking the CI checkout token into shipped images, so
git pullon installed boxes works without a credential prompt.The bug
On an installed box,
git pullin/etc/nixos-repoprompts for a GitHub username while a freshgit cloneof the same public repo works anonymously:Root cause
actions/checkoutdefaults topersist-credentials: true, which writes the job's short-lived token into.git/configashttp.https://github.com/.extraheader.box-turnkey.nixbakes the working tree into the image at/etc/nixos-repoviaself.outPath(which includes.giton the dirty CI build), so that token ships in every installer/appliance image and lands on installed boxes. The token expired ~1h after the build, so on the boxgit pullsends a dead credential → GitHub401→ git prompts for a username. A freshgit clonehas no such header and fetches anonymously, which is why clone works but pull doesn't.Fix
Set
persist-credentials: falseon the two checkouts whose tree gets baked into an image:test.yml→Imagesjobrelease.yml→buildjobThe
.gitdirectory andoriginare still shipped, sogit pullkeeps working — just anonymously, which is fine for a public repo. The initial CI fetch still authenticates; nothing downstream relies on the persisted credential (no workflow pushes via git, and the release publishes throughsoftprops/action-gh-releaseusingGITHUB_TOKEN). Nix fetches flake inputs with its own fetcher, unaffected.Validation
actionlintclean on both workflows; YAML parses.Existing boxes
Images built before this merges still carry the dead token. On an affected box, drop it once:
New images built after this won't have it.
Generated by Coder Agents on behalf of @phorcys420.