From c013b97ba0e7b6baf0e429dce3d31e1e2a22496e Mon Sep 17 00:00:00 2001 From: Anish Sujanani Date: Thu, 17 Sep 2026 11:05:13 +0530 Subject: [PATCH] Set persist-credentials: false on actions/checkout actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting persist-credentials: false removes it, as defence in depth against a later step exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036. --- .github/workflows/publish_pypi.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/publish_pypi.yml b/.github/workflows/publish_pypi.yml index fe79a5b..5f84e82 100644 --- a/.github/workflows/publish_pypi.yml +++ b/.github/workflows/publish_pypi.yml @@ -11,6 +11,8 @@ jobs: steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@v5