From 2bc77ef7d69d18a85f8770ce38828de41631c4e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Phorcys=20=F0=9F=90=BE?= Date: Mon, 24 Aug 2026 22:26:05 +0000 Subject: [PATCH] ci: don't bake the checkout token into shipped images actions/checkout defaults to persist-credentials: true, which writes the job's short-lived GitHub token into .git/config as `http.https://github.com/.extraheader`. box-turnkey.nix bakes the working tree (self.outPath, including .git) into the image at /etc/nixos-repo, so that dead token ships in every installer/appliance image and lands on installed boxes. `git pull` there then sends the expired token, GitHub returns 401, and git prompts for a username (a fresh `git clone` has no such header and works anonymously). Set persist-credentials: false on the two checkouts whose tree is baked (test.yml Images, release.yml build). The repo is public, so the box's `git pull` works anonymously; the .git and origin are preserved. No workflow pushes via git, and the release uses GITHUB_TOKEN through action-gh-release, so nothing else relies on the persisted credential. --- .github/workflows/release.yml | 6 ++++++ .github/workflows/test.yml | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d93cb68..e158d3c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -82,6 +82,12 @@ jobs: # Empty for tag push (checks out the tag); honored for manual dispatch # to release an arbitrary commit. ref: ${{ github.event.inputs.ref }} + # This working tree is baked into the image at /etc/nixos-repo (via + # box-turnkey.nix's self.outPath). Don't persist the job token as an + # http.*.extraheader in .git/config, or the dead token ships in the + # image and makes `git pull` on installed boxes prompt for creds. The + # repo is public, so `git pull` on the box works anonymously. + persist-credentials: false # Install Nix natively + cache the /nix/store (shared with the test # workflow so releases build the exact same way). diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 72fe395..81c4088 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -170,6 +170,14 @@ jobs: # Empty for push/PR (checks out the event ref); honored for manual # dispatch to build an arbitrary commit. ref: ${{ github.event.inputs.ref }} + # This working tree is baked into the image at /etc/nixos-repo (via + # box-turnkey.nix's self.outPath). actions/checkout defaults to + # persisting the job's short-lived token as an http.*.extraheader in + # .git/config; baked in, that dead token makes `git pull` on installed + # boxes prompt for credentials. Don't persist it (the repo is public; + # the initial fetch still authenticates, and `git pull` on the box + # works anonymously). + persist-credentials: false # Install Nix natively + cache the /nix/store (shared with the release # workflow so both build images the exact same way).