From f8aef335c9aa2cba86ae19422ce57dfb3d5f2bc0 Mon Sep 17 00:00:00 2001 From: Jakob Wennberg <149234542+jakobwennberg@users.noreply.github.com> Date: Tue, 30 Jun 2026 08:57:58 +0200 Subject: [PATCH] fix(ci): persist-credentials: false on the privileged compliance-review checkout (#831) Stage 2 holds a write token + AWS secrets and never needs git push creds; don't leave the token persisted in .git/config for the steps that process the untrusted diff artifact. Closes the Superagent P2 follow-up. Co-authored-by: Claude Opus 4.8 (1M context) --- .github/workflows/swedish-compliance-review.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/swedish-compliance-review.yml b/.github/workflows/swedish-compliance-review.yml index d0876839..23de2970 100644 --- a/.github/workflows/swedish-compliance-review.yml +++ b/.github/workflows/swedish-compliance-review.yml @@ -28,7 +28,11 @@ jobs: github.event.workflow_run.conclusion == 'success' steps: # Base repo only — the TRUSTED copy of the script and .claude/skills/. + # persist-credentials: false — no later step needs git push creds, so don't + # leave the token in .git/config for the steps that handle untrusted input. - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20