From f83577dbfcaf3ca2b5bb88d9d7cfbe80d07b978b Mon Sep 17 00:00:00 2001 From: Nicola Soranzo Date: Fri, 30 Jan 2026 17:06:57 +0000 Subject: [PATCH] Don't persist credentials when checking out repositories --- .github/workflows/build_container_image.yaml | 3 +-- .github/workflows/publish_artifacts.yaml | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_container_image.yaml b/.github/workflows/build_container_image.yaml index 2058a1c78af..49f0e11c627 100644 --- a/.github/workflows/build_container_image.yaml +++ b/.github/workflows/build_container_image.yaml @@ -238,8 +238,7 @@ jobs: uses: actions/checkout@v6 with: repository: galaxyproject/galaxy-helm - token: ${{ secrets.GITHUB_TOKEN }} - persist-credentials: true + persist-credentials: false - name: Update Chart.yaml appVersion run: | diff --git a/.github/workflows/publish_artifacts.yaml b/.github/workflows/publish_artifacts.yaml index 027042e043f..8ba98a7e604 100644 --- a/.github/workflows/publish_artifacts.yaml +++ b/.github/workflows/publish_artifacts.yaml @@ -76,6 +76,7 @@ jobs: - uses: actions/checkout@v6 with: ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || '' }} + persist-credentials: false - name: Read Node.js version id: node-version run: echo "version=$(cat client/.node_version)" >> $GITHUB_OUTPUT