From 737b05bafa3fcb85881f9cf4da3dab5d08945844 Mon Sep 17 00:00:00 2001 From: Victor Garcia Date: Fri, 7 Aug 2026 23:13:03 -0700 Subject: [PATCH 1/2] ci: bump actions/checkout to v7 The first CI run on main warned that actions/checkout@v4 targets Node.js 20 and is being force-run on Node 24. v5 onward all ship `using: node24`; v7.0.1 is the current stable major. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01PfAfAujueuZ3rDTiL9apx3 --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 036c1d1..82c53c4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: matrix: os: [ubuntu-latest, macos-latest] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # No toolchain action: rust-toolchain.toml is the single source of the # version, so CI and local builds cannot drift. Installing explicitly @@ -45,7 +45,7 @@ jobs: name: clippy runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install pinned toolchain run: rustup toolchain install --no-self-update From 0a6dd79aa4daa1f1169dfa705ad6db8575350396 Mon Sep 17 00:00:00 2001 From: Victor Garcia Date: Fri, 7 Aug 2026 23:15:57 -0700 Subject: [PATCH 2/2] ci: disable credential persistence on checkout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit checkout defaults to persist-credentials: true, which leaves the job token in .git/config where it can escape through uploaded artifacts (the "artipacked" class; flagged by zizmor via CodeRabbit). Neither job does authenticated git work — they install a toolchain and run cargo — so persisting the credential is exposure with no upside. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01PfAfAujueuZ3rDTiL9apx3 --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 82c53c4..7a75465 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,11 @@ jobs: matrix: os: [ubuntu-latest, macos-latest] steps: + # persist-credentials: false — no step here does authenticated git work, + # so leaving the token in .git/config is exposure with no upside. - uses: actions/checkout@v7 + with: + persist-credentials: false # No toolchain action: rust-toolchain.toml is the single source of the # version, so CI and local builds cannot drift. Installing explicitly @@ -46,6 +50,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - name: Install pinned toolchain run: rustup toolchain install --no-self-update