actions/checkout persist-credentials: why to turn it off
By default actions/checkout writes the job's token into the repository's .git/config so later git commands are authenticated. Every later step in the job, including third-party actions and scripts from dependencies, can read it from there.
Switch it off unless a later step pushes
Most jobs only read the code. Set persist-credentials: false on checkout, and pass a token explicitly to the one step that needs to push.
- uses: actions/checkout@<sha> # v4
with:
persist-credentials: falseWhy it matters with artifacts
A job that uploads its workspace as an artifact can upload .git/config with it. Turning persistence off keeps the token out of anything the job publishes.
What Anchorflow checks
Anchorflow flags actions/checkout steps that set persist-credentials: true, and steps that leave the default in jobs with an elevated trigger or untrusted input, with the job and line.
Check your workflow