Dmitry V. Levin
6461eccacb
Set `persist-credentials: false` for actions/checkout. By default, using `actions/checkout` causes a credential to be persisted on disk. Subsequent steps may accidentally publicly persist the credential, e.g. by including it in a publicly accessible artifact via actions/upload-artifact. However, even without this, persisting the credential on disk is non-ideal unless actually needed. Link: https://docs.zizmor.sh/audits/#artipacked
33 lines
830 B
YAML
33 lines
830 B
YAML
---
|
|
|
|
name: Gather Pull Request Metadata
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [ main ]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
gather-metadata:
|
|
if: github.repository == 'systemd/systemd'
|
|
runs-on: ubuntu-24.04
|
|
|
|
steps:
|
|
- name: Repository checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- id: metadata
|
|
name: Gather Pull Request Metadata
|
|
uses: redhat-plumbers-in-action/gather-pull-request-metadata@b86d1eaf7038cf88a56b26ba3e504f10e07b0ce5
|
|
|
|
- name: Upload Pull Request Metadata artifact
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
|
|
with:
|
|
name: Pull Request Metadata
|
|
path: ${{ steps.metadata.outputs.metadata-file }}
|
|
retention-days: 1
|