hai/everything-claude-code
1
0
Fork 0
mirror of https://github.com/affaan-m/everything-claude-code.git synced 2026-05-14 16:38:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

ci: disable checkout credential persistence in privileged workflows (#1851)

Browse Source
This commit is contained in:
Affaan Mustafa
2026-05-13 01:15:49 -04:00
committed by GitHub
parent 2486732714
commit 209abd403b
5 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
scripts/ci/validate-workflow-security.js
View File

@@ -108,6 +108,18 @@ function findViolations(filePath, source) {
}
if (WRITE_PERMISSION_PATTERN.test(source)) {
for (const step of checkoutSteps) {
if (!/persist-credentials:\s*['"]?false['"]?\b/m.test(step.text)) {
violations.push({
filePath,
event: 'write-permission checkout',
description: 'workflows with write permissions must disable checkout credential persistence',
expression: 'actions/checkout without persist-credentials: false',
line: step.startLine,
});
}
}
for (const match of source.matchAll(NPM_CI_PATTERN)) {
violations.push({
filePath,