From 30b60e690a9e4589b0185b04b99ef671b14b06e0 Mon Sep 17 00:00:00 2001 From: Jax Liu Date: Mon, 7 Sep 2026 16:27:18 +0800 Subject: [PATCH] ci: stop persisting the checkout token in the context loader job The job builds and tests pull-request-authored code, and `actions/checkout` leaves the token in the checkout by default, where a build script or a test can read it. Nothing in this job touches git past the checkout, so the credentials are pure downside. Matches how the SDK workflow already checks out. --- .github/workflows/context-loader-ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/context-loader-ci.yml b/.github/workflows/context-loader-ci.yml index ed3b14595..f49fbcbd1 100644 --- a/.github/workflows/context-loader-ci.yml +++ b/.github/workflows/context-loader-ci.yml @@ -29,7 +29,12 @@ jobs: name: fmt, clippy, test runs-on: ubuntu-latest steps: + # No credentials persisted: this job builds and tests pull-request-authored code, and a + # build script or test could otherwise read the token out of the checkout. Nothing here + # touches git beyond the checkout itself. - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Setup Rust toolchain uses: dtolnay/rust-toolchain@stable