Merge pull request #71 from traveltime-dev/actions-checkout-security-fix

CI: disable persist-credentials for actions/checkout
traveltime-dev · Oct 25, 2024 · 6005fb3 · 6005fb3
2 parents d2391c3 + 9e260fa
commit 6005fb3
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/.github/workflows/build_image.yml b/.github/workflows/build_image.yml
@@ -12,6 +12,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Build the Docker image
         run: |
           docker build -t igeolise/traveltime-k6-benchmarks:${GITHUB_SHA::7} -t igeolise/traveltime-k6-benchmarks:latest .

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -10,6 +10,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v3
+      with:
+        persist-credentials: false
     - name: Use Node.js
       uses: actions/setup-node@v3
       with: