From c677909dc9370f96a21d94efb9634f3a796de9f1 Mon Sep 17 00:00:00 2001 From: tomas Date: Mon, 20 Jul 2026 09:31:35 +0000 Subject: [PATCH 1/2] ci: disable persisted credentials in checkout steps Set `persist-credentials: false` on every `actions/checkout` step in the CD, CI and dependency-check workflows, so the GitHub token is not left behind in the local Git config while repository-controlled npm commands run. This shortens the window in which the workflow token is available to build and packaging steps. All affected jobs are read-only: none push, tag, or otherwise use the persisted credentials, and both `permissions:` blocks are already `contents: read`. The qlty job keeps `fetch-depth: 0` (credentials are only dropped after the fetch), and the drift check's `git diff` is a purely local operation, so checkout behaviour is otherwise unchanged. `.github/workflows/e2e.yml` already set the flag and is left untouched. Closes #444 Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01129DHTrr8BrrnBCaiLVzYv --- .github/workflows/cd.yml | 2 ++ .github/workflows/ci.yml | 17 +++++++++++++++++ .github/workflows/deps.yml | 4 ++++ 3 files changed, 23 insertions(+) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 473d733d08..175eac90d1 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -22,6 +22,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fc1833d747..a9030540cf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,6 +23,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -46,6 +48,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -69,6 +73,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: fetch-depth: 0 + persist-credentials: false - name: Install qlty uses: qltysh/qlty-action/install@141b881236146435192435eb7b0e06ea0b70b4d9 @@ -89,6 +94,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -141,6 +148,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -161,6 +170,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -181,6 +192,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -202,6 +215,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -223,6 +238,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml index f4e70908ea..1ce1a56a7a 100644 --- a/.github/workflows/deps.yml +++ b/.github/workflows/deps.yml @@ -21,6 +21,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -50,6 +52,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 From d9870019f0992fce2b28ecfcc210527e736e4176 Mon Sep 17 00:00:00 2001 From: tomas Date: Tue, 28 Jul 2026 14:48:14 +0000 Subject: [PATCH 2/2] ci: use full versions in action pin comments The `# vX` comments next to SHA-pinned actions had drifted from the SHAs they annotate: every actions/checkout and actions/setup-node pin was commented `# v6` while the SHA was already v7.x. Resolve each pinned SHA against the GitHub tags API and write the full version it corresponds to. Also repin qltysh/qlty-action/install to v2.3.0 (08a0a862). Its previous SHA was an untagged main-branch commit, so no accurate version comment was possible - and that is why its bot PRs are titled `bump qltysh/qlty-action` with no version numbers, unlike every other action here. Back on a release tag, it can be tracked by version again. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01YFmRiqkZebrHeTBTHdwV3z --- .github/workflows/cd.yml | 4 ++-- .github/workflows/ci.yml | 40 +++++++++++++++++++------------------- .github/workflows/deps.yml | 8 ++++---- .github/workflows/e2e.yml | 4 ++-- 4 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 26f0df7e0a..df4ab5069b 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -21,12 +21,12 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2254a47a94..241b744104 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,12 +22,12 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' @@ -47,12 +47,12 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' @@ -70,13 +70,13 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - name: Install qlty - uses: qltysh/qlty-action/install@141b881236146435192435eb7b0e06ea0b70b4d9 + uses: qltysh/qlty-action/install@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0 - name: Run qlty check run: qlty check @@ -93,12 +93,12 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' @@ -120,7 +120,7 @@ jobs: VSC_JUPYTER_INSTRUMENT_CODE_FOR_COVERAGE: true - name: Upload coverage to Codecov - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: use_oidc: true files: coverage/lcov.info @@ -128,7 +128,7 @@ jobs: - name: Upload test results to Codecov if: '!cancelled()' - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: use_oidc: true files: test-results.xml @@ -147,12 +147,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' @@ -169,12 +169,12 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' @@ -191,12 +191,12 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' @@ -214,12 +214,12 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' @@ -237,12 +237,12 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml index b1e36d76cf..b8c3af9e58 100644 --- a/.github/workflows/deps.yml +++ b/.github/workflows/deps.yml @@ -20,12 +20,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc' @@ -51,12 +51,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: '.nvmrc' cache: 'npm' diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index c9dee1a2fe..a28c014d37 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -28,12 +28,12 @@ jobs: TEST_RESOURCES: ${{ github.workspace }}/test-resources steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'npm' node-version-file: '.nvmrc'