From 482b2c42041a2211fb385fbe79fb1c64366adbb2 Mon Sep 17 00:00:00 2001 From: Jamison Lahman Date: Wed, 19 Nov 2025 14:26:45 -0800 Subject: [PATCH] chore(gha): run `uvx zizmor --fix=all` (#6342) --- .github/workflows/check-lazy-imports.yml | 2 + .github/workflows/deployment.yml | 59 +++++++++++++++---- .github/workflows/helm-chart-releases.yml | 1 + .github/workflows/nightly-scan-licenses.yml | 2 + .../pr-external-dependency-unit-tests.yml | 4 ++ .github/workflows/pr-helm-chart-testing.yml | 1 + .github/workflows/pr-integration-tests.yml | 12 ++++ .github/workflows/pr-jest-tests.yml | 2 + .../workflows/pr-mit-integration-tests.yml | 10 ++++ .github/workflows/pr-playwright-tests.yml | 7 +++ .github/workflows/pr-python-checks.yml | 2 + .../workflows/pr-python-connector-tests.yml | 2 + .github/workflows/pr-python-model-tests.yml | 2 + .github/workflows/pr-python-tests.yml | 2 + .github/workflows/pr-quality-checks.yml | 1 + .github/workflows/sync_foss.yml | 1 + .github/workflows/tag-nightly.yml | 1 + 17 files changed, 98 insertions(+), 13 deletions(-) diff --git a/.github/workflows/check-lazy-imports.yml b/.github/workflows/check-lazy-imports.yml index 3a058bf8b1..a2ee065052 100644 --- a/.github/workflows/check-lazy-imports.yml +++ b/.github/workflows/check-lazy-imports.yml @@ -17,6 +17,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # ratchet:actions/setup-python@v6 diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml index 14d4495c1f..409e18294a 100644 --- a/.github/workflows/deployment.yml +++ b/.github/workflows/deployment.yml @@ -30,7 +30,7 @@ jobs: - name: Check which components to build and version info id: check run: | - TAG="${{ github.ref_name }}" + TAG="${GITHUB_REF_NAME}" # Sanitize tag name by replacing slashes with hyphens (for Docker tag compatibility) SANITIZED_TAG=$(echo "$TAG" | tr '/' '-') IS_CLOUD=false @@ -96,6 +96,8 @@ jobs: - name: Checkout uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Docker meta id: meta @@ -151,6 +153,8 @@ jobs: - name: Checkout uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Docker meta id: meta @@ -250,6 +254,8 @@ jobs: - name: Checkout uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Docker meta id: meta @@ -313,6 +319,8 @@ jobs: - name: Checkout uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Docker meta id: meta @@ -417,6 +425,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Docker meta id: meta @@ -471,6 +481,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Docker meta id: meta @@ -570,6 +582,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Docker meta id: meta @@ -631,6 +645,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Docker meta id: meta @@ -813,6 +829,8 @@ jobs: - name: Checkout uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Run Trivy vulnerability scanner uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # ratchet:nick-fields/retry@v3 @@ -899,51 +917,66 @@ jobs: steps: - name: Checkout uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Determine failed jobs id: failed-jobs shell: bash run: | FAILED_JOBS="" - if [ "${{ needs.build-web-amd64.result }}" == "failure" ]; then + if [ "${NEEDS_BUILD_WEB_AMD64_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• build-web-amd64\\n" fi - if [ "${{ needs.build-web-arm64.result }}" == "failure" ]; then + if [ "${NEEDS_BUILD_WEB_ARM64_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• build-web-arm64\\n" fi - if [ "${{ needs.merge-web.result }}" == "failure" ]; then + if [ "${NEEDS_MERGE_WEB_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• merge-web\\n" fi - if [ "${{ needs.build-web-cloud-amd64.result }}" == "failure" ]; then + if [ "${NEEDS_BUILD_WEB_CLOUD_AMD64_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• build-web-cloud-amd64\\n" fi - if [ "${{ needs.build-web-cloud-arm64.result }}" == "failure" ]; then + if [ "${NEEDS_BUILD_WEB_CLOUD_ARM64_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• build-web-cloud-arm64\\n" fi - if [ "${{ needs.merge-web-cloud.result }}" == "failure" ]; then + if [ "${NEEDS_MERGE_WEB_CLOUD_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• merge-web-cloud\\n" fi - if [ "${{ needs.build-backend-amd64.result }}" == "failure" ]; then + if [ "${NEEDS_BUILD_BACKEND_AMD64_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• build-backend-amd64\\n" fi - if [ "${{ needs.build-backend-arm64.result }}" == "failure" ]; then + if [ "${NEEDS_BUILD_BACKEND_ARM64_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• build-backend-arm64\\n" fi - if [ "${{ needs.merge-backend.result }}" == "failure" ]; then + if [ "${NEEDS_MERGE_BACKEND_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• merge-backend\\n" fi - if [ "${{ needs.build-model-server-amd64.result }}" == "failure" ]; then + if [ "${NEEDS_BUILD_MODEL_SERVER_AMD64_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• build-model-server-amd64\\n" fi - if [ "${{ needs.build-model-server-arm64.result }}" == "failure" ]; then + if [ "${NEEDS_BUILD_MODEL_SERVER_ARM64_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• build-model-server-arm64\\n" fi - if [ "${{ needs.merge-model-server.result }}" == "failure" ]; then + if [ "${NEEDS_MERGE_MODEL_SERVER_RESULT}" == "failure" ]; then FAILED_JOBS="${FAILED_JOBS}• merge-model-server\\n" fi # Remove trailing \n and set output FAILED_JOBS=$(printf '%s' "$FAILED_JOBS" | sed 's/\\n$//') echo "jobs=$FAILED_JOBS" >> "$GITHUB_OUTPUT" + env: + NEEDS_BUILD_WEB_AMD64_RESULT: ${{ needs.build-web-amd64.result }} + NEEDS_BUILD_WEB_ARM64_RESULT: ${{ needs.build-web-arm64.result }} + NEEDS_MERGE_WEB_RESULT: ${{ needs.merge-web.result }} + NEEDS_BUILD_WEB_CLOUD_AMD64_RESULT: ${{ needs.build-web-cloud-amd64.result }} + NEEDS_BUILD_WEB_CLOUD_ARM64_RESULT: ${{ needs.build-web-cloud-arm64.result }} + NEEDS_MERGE_WEB_CLOUD_RESULT: ${{ needs.merge-web-cloud.result }} + NEEDS_BUILD_BACKEND_AMD64_RESULT: ${{ needs.build-backend-amd64.result }} + NEEDS_BUILD_BACKEND_ARM64_RESULT: ${{ needs.build-backend-arm64.result }} + NEEDS_MERGE_BACKEND_RESULT: ${{ needs.merge-backend.result }} + NEEDS_BUILD_MODEL_SERVER_AMD64_RESULT: ${{ needs.build-model-server-amd64.result }} + NEEDS_BUILD_MODEL_SERVER_ARM64_RESULT: ${{ needs.build-model-server-arm64.result }} + NEEDS_MERGE_MODEL_SERVER_RESULT: ${{ needs.merge-model-server.result }} - name: Send Slack notification uses: ./.github/actions/slack-notify diff --git a/.github/workflows/helm-chart-releases.yml b/.github/workflows/helm-chart-releases.yml index 557a9c6038..1185163627 100644 --- a/.github/workflows/helm-chart-releases.yml +++ b/.github/workflows/helm-chart-releases.yml @@ -17,6 +17,7 @@ jobs: uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - name: Install Helm CLI uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # ratchet:azure/setup-helm@v4 diff --git a/.github/workflows/nightly-scan-licenses.yml b/.github/workflows/nightly-scan-licenses.yml index b3c14f191b..17879175b6 100644 --- a/.github/workflows/nightly-scan-licenses.yml +++ b/.github/workflows/nightly-scan-licenses.yml @@ -25,6 +25,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # ratchet:actions/setup-python@v6 diff --git a/.github/workflows/pr-external-dependency-unit-tests.yml b/.github/workflows/pr-external-dependency-unit-tests.yml index d62fafc8e7..44fdba2fd5 100644 --- a/.github/workflows/pr-external-dependency-unit-tests.yml +++ b/.github/workflows/pr-external-dependency-unit-tests.yml @@ -37,6 +37,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Discover test directories id: set-matrix @@ -67,6 +69,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Setup Python and Install Dependencies uses: ./.github/actions/setup-python-and-install-dependencies diff --git a/.github/workflows/pr-helm-chart-testing.yml b/.github/workflows/pr-helm-chart-testing.yml index 2c56deefa0..5719d72298 100644 --- a/.github/workflows/pr-helm-chart-testing.yml +++ b/.github/workflows/pr-helm-chart-testing.yml @@ -20,6 +20,7 @@ jobs: uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - name: Set up Helm uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # ratchet:azure/setup-helm@v4.3.1 diff --git a/.github/workflows/pr-integration-tests.yml b/.github/workflows/pr-integration-tests.yml index 4bb94ed58c..85356b1f4a 100644 --- a/.github/workflows/pr-integration-tests.yml +++ b/.github/workflows/pr-integration-tests.yml @@ -37,6 +37,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Discover test directories id: set-matrix @@ -65,6 +67,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -99,6 +103,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -131,6 +137,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -180,6 +188,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false # needed for pulling Vespa, Redis, Postgres, and Minio images # otherwise, we hit the "Unauthenticated users" limit @@ -334,6 +344,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Login to Docker Hub uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3 diff --git a/.github/workflows/pr-jest-tests.yml b/.github/workflows/pr-jest-tests.yml index d18d838ba6..8dff59ec70 100644 --- a/.github/workflows/pr-jest-tests.yml +++ b/.github/workflows/pr-jest-tests.yml @@ -12,6 +12,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Setup node uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # ratchet:actions/setup-node@v4 diff --git a/.github/workflows/pr-mit-integration-tests.yml b/.github/workflows/pr-mit-integration-tests.yml index 5bac379e8b..4e49517911 100644 --- a/.github/workflows/pr-mit-integration-tests.yml +++ b/.github/workflows/pr-mit-integration-tests.yml @@ -33,6 +33,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Discover test directories id: set-matrix @@ -60,6 +62,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -92,6 +96,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -123,6 +129,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -172,6 +180,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false # needed for pulling Vespa, Redis, Postgres, and Minio images # otherwise, we hit the "Unauthenticated users" limit diff --git a/.github/workflows/pr-playwright-tests.yml b/.github/workflows/pr-playwright-tests.yml index a94f751f06..cd59ed7a19 100644 --- a/.github/workflows/pr-playwright-tests.yml +++ b/.github/workflows/pr-playwright-tests.yml @@ -42,6 +42,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -75,6 +77,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -109,6 +113,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3 @@ -150,6 +156,7 @@ jobs: uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - name: Setup node uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # ratchet:actions/setup-node@v4 diff --git a/.github/workflows/pr-python-checks.yml b/.github/workflows/pr-python-checks.yml index 7fa068f752..61d7663566 100644 --- a/.github/workflows/pr-python-checks.yml +++ b/.github/workflows/pr-python-checks.yml @@ -21,6 +21,8 @@ jobs: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2 - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false # needed for pulling openapitools/openapi-generator-cli # otherwise, we hit the "Unauthenticated users" limit diff --git a/.github/workflows/pr-python-connector-tests.yml b/.github/workflows/pr-python-connector-tests.yml index a6154fae0b..542b2b0475 100644 --- a/.github/workflows/pr-python-connector-tests.yml +++ b/.github/workflows/pr-python-connector-tests.yml @@ -132,6 +132,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Setup Python and Install Dependencies uses: ./.github/actions/setup-python-and-install-dependencies diff --git a/.github/workflows/pr-python-model-tests.yml b/.github/workflows/pr-python-model-tests.yml index 03adf0dd72..77607b7f8b 100644 --- a/.github/workflows/pr-python-model-tests.yml +++ b/.github/workflows/pr-python-model-tests.yml @@ -36,6 +36,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Login to Docker Hub uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3 diff --git a/.github/workflows/pr-python-tests.yml b/.github/workflows/pr-python-tests.yml index 7addfb71d2..71a986c77d 100644 --- a/.github/workflows/pr-python-tests.yml +++ b/.github/workflows/pr-python-tests.yml @@ -28,6 +28,8 @@ jobs: - name: Checkout code uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 + with: + persist-credentials: false - name: Setup Python and Install Dependencies uses: ./.github/actions/setup-python-and-install-dependencies diff --git a/.github/workflows/pr-quality-checks.yml b/.github/workflows/pr-quality-checks.yml index c7094464b7..7d40cb411f 100644 --- a/.github/workflows/pr-quality-checks.yml +++ b/.github/workflows/pr-quality-checks.yml @@ -16,6 +16,7 @@ jobs: - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # ratchet:actions/setup-python@v6 with: python-version: "3.11" diff --git a/.github/workflows/sync_foss.yml b/.github/workflows/sync_foss.yml index af4f05f420..c388dcae04 100644 --- a/.github/workflows/sync_foss.yml +++ b/.github/workflows/sync_foss.yml @@ -16,6 +16,7 @@ jobs: uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - name: Install git-filter-repo run: | diff --git a/.github/workflows/tag-nightly.yml b/.github/workflows/tag-nightly.yml index bafe4d1f10..447b3d6c87 100644 --- a/.github/workflows/tag-nightly.yml +++ b/.github/workflows/tag-nightly.yml @@ -22,6 +22,7 @@ jobs: uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 with: ssh-key: "${{ secrets.RKUO_DEPLOY_KEY }}" + persist-credentials: false - name: Set up Git user run: |