ci: disable credential persistence in checkout steps by Adarshkumar0509 · Pull Request #4817 · OWASP/Nest

Adarshkumar0509 · 2026-06-02T04:52:16Z

Resolves #4803

Set persist-credentials: false on all actions/checkout steps across all workflow files to prevent credential leakage through artifacts or logs.

By default, actions/checkout persists GitHub credentials in the local git config after checkout. This is unnecessary for workflows that only perform read-only operations and creates a security risk if credentials are exposed through artifacts or logs.

Changes

.github/workflows/run-ci-cd.yaml and 21 checkout steps updated
.github/workflows/run-fuzz-tests.yaml 1 checkout step updated
.github/workflows/run-code-ql.yaml 1 checkout step updated
.github/workflows/check-pr-issue.yaml 1 checkout step updated
.github/workflows/update-nest-test-images.yaml 1 checkout step updated

Checklist

Required: I followed the contributing workflow
Required: I verified that my code works as intended and resolves the issue as described
Required: I ran make check-test locally: all warnings addressed, tests passed
I used AI for code, documentation, tests, or communication related to this PR

coderabbitai · 2026-06-02T04:52:28Z

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2ab5898c-b5e3-4e07-98fe-54d91ba075f4

📥 Commits

Reviewing files that changed from the base of the PR and between c7ed381 and 6feb204.

📒 Files selected for processing (3)

.github/workflows/run-ci-cd.yaml
.github/workflows/run-code-ql.yaml
.github/workflows/run-fuzz-tests.yaml

Summary by CodeRabbit

Chores
- Reinforced CI/CD pipeline security by preventing credentials from being retained in job workspaces.
- Applied the update across repository automation, including CI, testing, and analysis workflows to reduce exposure risk.

Walkthrough

Add persist-credentials: false to actions/checkout steps across the modified GitHub Actions workflows, ensuring checkout steps no longer persist GitHub credentials to the workspace.

Changes

GitHub Actions Credential Persistence Hardening

Layer / File(s)	Summary
Disable credential persistence in all workflow checkouts `.github/workflows/check-pr-issue.yaml`, `.github/workflows/run-ci-cd.yaml`, `.github/workflows/run-code-ql.yaml`, `.github/workflows/run-fuzz-tests.yaml`, `.github/workflows/update-nest-test-images.yaml`	Each `actions/checkout` step in these workflows is updated to include `with:` configuration setting `persist-credentials: false`. Changes appear across multiple jobs in `run-ci-cd.yaml` and single-step edits in the other workflow files.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

OWASP/Nest#1195: Also modifies actions/checkout usage in workflows (pins action vs. this PR adding persist-credentials: false).

Suggested reviewers

arkid15r
kasya

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci: disable credential persistence in checkout steps' clearly and specifically describes the main change across all workflow files.
Description check	✅ Passed	The description provides relevant context about the security issue being resolved, the rationale for the changes, and lists all affected files with specific details.
Linked Issues check	✅ Passed	The PR successfully addresses issue `#4803` by adding persist-credentials: false to all actions/checkout steps across multiple workflow files to prevent credential leakage.
Out of Scope Changes check	✅ Passed	All changes focus solely on disabling credential persistence in checkout steps across workflow files, with no unrelated modifications to other code or configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Adarshkumar0509 · 2026-06-02T05:00:08Z

hii @arkid15r please take a look at this whenever you have time.

cubic-dev-ai

No issues found across 5 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

sonarqubecloud · 2026-06-02T16:58:35Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/run-ci-cd.yaml:
- Around line 174-176: The checkout step named "Check out repository" using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd should explicitly set
persist-credentials: false to avoid persisting the GITHUB_TOKEN; update that
step (the "Check out repository" step referencing
actions/checkout@de0fac2e45...) to include a with: block containing
persist-credentials: false so the audit-dependencies job does not retain
credentials after checkout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2ab5898c-b5e3-4e07-98fe-54d91ba075f4

📥 Commits

Reviewing files that changed from the base of the PR and between c7ed381 and 6feb204.

📒 Files selected for processing (3)

.github/workflows/run-ci-cd.yaml
.github/workflows/run-code-ql.yaml
.github/workflows/run-fuzz-tests.yaml

codecov · 2026-06-02T17:03:05Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.86%. Comparing base (60801db) to head (6feb204).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4817   +/-   ##
=======================================
  Coverage   98.86%   98.86%           
=======================================
  Files         538      538           
  Lines       17157    17157           
  Branches     2406     2406           
=======================================
  Hits        16963    16963           
  Misses        105      105           
  Partials       89       89

Flag	Coverage Δ
backend	`99.45% <ø> (ø)`
frontend	`97.26% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 60801db...6feb204. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/run-ci-cd.yaml:
- Around line 174-176: The checkout step named "Check out repository" using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd should explicitly set
persist-credentials: false to avoid persisting the GITHUB_TOKEN; update that
step (the "Check out repository" step referencing
actions/checkout@de0fac2e45...) to include a with: block containing
persist-credentials: false so the audit-dependencies job does not retain
credentials after checkout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2ab5898c-b5e3-4e07-98fe-54d91ba075f4

📥 Commits

Reviewing files that changed from the base of the PR and between c7ed381 and 6feb204.

📒 Files selected for processing (3)

.github/workflows/run-ci-cd.yaml
.github/workflows/run-code-ql.yaml
.github/workflows/run-fuzz-tests.yaml

🛑 Comments failed to post (1)

.github/workflows/run-ci-cd.yaml (1)

174-176: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
python - <<'PY'
from pathlib import Path

path = Path(".github/workflows/run-ci-cd.yaml")
lines = path.read_text().splitlines()

for i, line in enumerate(lines):
    if "uses: actions/checkout@" in line:
        block = lines[i:i+6]
        if not any("persist-credentials: false" in entry for entry in block):
            print(f"{path}:{i+1}")
            print("\n".join(block))
            print("---")
PY

Repository: OWASP/Nest

Length of output: 331

🏁 Script executed:

#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re

path = Path(".github/workflows/run-ci-cd.yaml")
lines = path.read_text().splitlines()

# Find step list items that are at some indent and start with "- "
# Then, within each step, detect uses: actions/checkout@...
step_start_re = re.compile(r'^(?P<indent>\s*)-\s+name:\s+.*$')
uses_checkout_re = re.compile(r'^\s*uses:\s*actions/checkout@')
persist_re = re.compile(r'^\s*persist-credentials:\s*false\s*$')

# Also detect "- name:" step; checkout could appear without name, but in this file it seems present.
# We'll locate "uses: actions/checkout@" lines and then expand to the owning "- ..." step block by indent.
checkout_indices = [i for i,l in enumerate(lines) if 'uses: actions/checkout@' in l]
missing = []

def step_block(i):
    # Determine indent of the "- " line that begins the step.
    # Walk upward to find the nearest "- " line at same indentation level.
    # First find the indent of the uses line
    uses_indent = len(lines[i]) - len(lines[i].lstrip(' '))
    # Walk up to find line that starts with "- " at indentation < uses_indent
    j = i
    while j >= 0:
        l = lines[j]
        if re.match(r'^\s*-\s+', l):
            dash_indent = len(l) - len(l.lstrip(' '))
            if dash_indent < uses_indent:
                step_indent = dash_indent
                # Find end: next line with "- " at same step_indent (or smaller) that starts a new step
                k = j+1
                while k < len(lines):
                    lk = lines[k]
                    if re.match(r'^\s*-\s+', lk):
                        ind = len(lk) - len(lk.lstrip(' '))
                        if ind == step_indent:
                            break
                    k += 1
                return j, k
        j -= 1
    return None

for idx in checkout_indices:
    rng = step_block(idx)
    if rng is None:
        continue
    start, end = rng
    block = lines[start:end]
    has_persist = any(persist_re.search(b) for b in block)
    if not has_persist:
        missing.append((idx+1, start+1, end, lines[idx].strip(), "\n".join(block[:min(len(block),25)])))

print("Missing checkout steps:", len(missing))
for m in missing:
    line_no, start_line, _, uses_line, preview = m
    print(f"\n- checkout uses line: {line_no} (step starts at {start_line})")
    print(uses_line)
PY

Repository: OWASP/Nest

Length of output: 202

Add with.persist-credentials: false to the audit-dependencies checkout.
.github/workflows/run-ci-cd.yaml (step starting at line 174; actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd at line 175) is missing the flag, leaving that token persistence hardening gap open.

Suggested fix

       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 174-175: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/run-ci-cd.yaml around lines 174 - 176, The checkout step
named "Check out repository" using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd should explicitly set
persist-credentials: false to avoid persisting the GITHUB_TOKEN; update that
step (the "Check out repository" step referencing
actions/checkout@de0fac2e45...) to include a with: block containing
persist-credentials: false so the audit-dependencies job does not retain
credentials after checkout.

arkid15r

Looks good

x

Adarshkumar0509 · 2026-06-02T17:27:21Z

Tysm

* chore(about): replace Ansible with Terraform in technologies section (#4800) * Pin dependencies, add audit step (#4802) * Pin dependencies, add audit step * Address review comments * Update code * feat(projects): add health indicators to project cards (#4678) * feat(projects): add project health indicators * fix: resolve merge conflicts * Fix tests * Update code * Update code --------- Co-authored-by: Kate <kate@kgthreads.com> Co-authored-by: Arkadii Yakovets <arkadii.yakovets@owasp.org> Co-authored-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com> * fix: improve mobile responsiveness on issues page (#4712) * fix: improve mobile responsiveness on issues page * fix: fix mobile dropdown caret position and double background on issues page * fix: address coderabbit suggestions for dropdown background and caret positioning * Update code --------- Co-authored-by: Kate Golovanova <kate@kgthreads.com> * test(alb): add deletion protection test coverage (#4796) Co-authored-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com> * chore(deps): bump aquasec/trivy (#4809) Bumps the version-updates group with 1 update in the /docker/trivy directory: aquasec/trivy. Updates `aquasec/trivy` from 0.70.0 to 0.71.0 --- updated-dependencies: - dependency-name: aquasec/trivy dependency-version: 0.71.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the version-updates group across 1 directory with 2 updates (#4810) Bumps the version-updates group with 2 updates in the / directory: [pnpm/action-setup](https://github.com/pnpm/action-setup) and [actions/dependency-review-action](https://github.com/actions/dependency-review-action). Updates `pnpm/action-setup` from 6.0.5 to 6.0.7 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@8912a91...739bfe4) Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@2031cfc...a1d282b) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: actions/dependency-review-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: version-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump @sentry/nextjs in /frontend (#4812) Bumps [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) in `/frontend` from 10.51.0 to 10.52.0. Updates `@sentry/nextjs` from 10.51.0 to 10.52.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.51.0...10.52.0) --- updated-dependencies: - dependency-name: "@sentry/nextjs" dependency-version: 10.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump db_engine_version to 16.13 * Bump pyjwt to v2.13.0 * Fix staging deployment process * ci: disable credential persistence in checkout steps (#4817) * ci: disable credential persistence in run-ci-cd.yaml * ci: disable credential persistence in run-fuzz-tests.yaml * ci: disable credential persistence in run-code-ql.yaml * ci: disable credential persistence in check-pr-issue.yaml * ci: disable credential persistence in update-nest-test-images.yaml --------- Co-authored-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com> * Bump Django to 6.0.6 * Bump aiohttp to 3.14.0 * chore(deps): bump the version-updates group across 1 directory with 2 updates (#4823) Bumps the version-updates group with 2 updates in the / directory: [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform) and [pnpm/action-setup](https://github.com/pnpm/action-setup). Updates `hashicorp/setup-terraform` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/hashicorp/setup-terraform/releases) - [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md) - [Commits](hashicorp/setup-terraform@5e8dbf3...dfe3c3f) Updates `pnpm/action-setup` from 6.0.7 to 6.0.8 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@739bfe4...0e279bb) --- updated-dependencies: - dependency-name: hashicorp/setup-terraform dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: pnpm/action-setup dependency-version: 6.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com> * chore(deps): bump @sentry/nextjs in /frontend (#4822) Bumps [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) in `/frontend` from 10.52.0 to 10.53.1. Updates `@sentry/nextjs` from 10.52.0 to 10.53.1 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.52.0...10.53.1) --- updated-dependencies: - dependency-name: "@sentry/nextjs" dependency-version: 10.53.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Adarsh Kumar <162141376+Adarshkumar0509@users.noreply.github.com> Co-authored-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com> Co-authored-by: Shuban Mutagi <shubanmutagi55@gmail.com> Co-authored-by: Kate <kate@kgthreads.com> Co-authored-by: Arkadii Yakovets <arkadii.yakovets@owasp.org> Co-authored-by: Anirudh <86768646+Ani07-05@users.noreply.github.com> Co-authored-by: Tanishq Meshram <tnshqmeshram@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Adarshkumar0509 added 5 commits June 2, 2026 04:29

ci: disable credential persistence in run-ci-cd.yaml

e60ffba

ci: disable credential persistence in run-fuzz-tests.yaml

cbff594

ci: disable credential persistence in run-code-ql.yaml

7aa680f

ci: disable credential persistence in check-pr-issue.yaml

540fda0

ci: disable credential persistence in update-nest-test-images.yaml

c7ed381

Adarshkumar0509 requested review from arkid15r and kasya as code owners June 2, 2026 04:52

github-actions Bot added the ci label Jun 2, 2026

coderabbitai Bot approved these changes Jun 2, 2026

View reviewed changes

cubic-dev-ai Bot approved these changes Jun 2, 2026

View reviewed changes

arkid15r mentioned this pull request Jun 2, 2026

Extract scan-images into a separate workflow #4710

Merged

4 tasks

Merge branch 'main' into fix/disable-credential-persistence

6feb204

coderabbitai Bot previously requested changes Jun 2, 2026

View reviewed changes

coderabbitai Bot reviewed Jun 2, 2026

View reviewed changes

arkid15r approved these changes Jun 2, 2026

View reviewed changes

arkid15r enabled auto-merge June 2, 2026 17:25

arkid15r added this pull request to the merge queue Jun 2, 2026

Merged via the queue into OWASP:main with commit 13d3a90 Jun 2, 2026
40 checks passed

Adarshkumar0509 deleted the fix/disable-credential-persistence branch June 3, 2026 18:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: disable credential persistence in checkout steps#4817

ci: disable credential persistence in checkout steps#4817
arkid15r merged 6 commits into
OWASP:mainfrom
Adarshkumar0509:fix/disable-credential-persistence

Adarshkumar0509 commented Jun 2, 2026

Uh oh!

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

Adarshkumar0509 commented Jun 2, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

sonarqubecloud Bot commented Jun 2, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

codecov Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

arkid15r left a comment

Uh oh!

Adarshkumar0509 commented Jun 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Adarshkumar0509 commented Jun 2, 2026

Changes

Checklist

Uh oh!

coderabbitai Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Uh oh!

Adarshkumar0509 commented Jun 2, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jun 2, 2026

Quality Gate passed

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

arkid15r left a comment

Choose a reason for hiding this comment

Uh oh!

Adarshkumar0509 commented Jun 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading

codecov Bot commented Jun 2, 2026 •

edited

Loading