Repository navigation
fix: avoid persisting release checkout credentials - #71802
Conversation
Keep checkout authentication for tag pushes while disabling unnecessary credential retention in the separate release job. Cover both source and compiled jobs with a credential regression test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Design Decision Gate 🏗️Outcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ PR Code Quality Reviewer completed the code quality review.
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality SentinelOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Ponytail Reviewer completed successfully! Ponytail ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
There was a problem hiding this comment.
🔵 Needs a closer look
Repository policy requires human security sign-off for release checkout credential changes, but the PR description records no approval.
1 open issue
What changed in this PR
Hardens gh-aw’s release workflow by removing unnecessary checkout credential persistence while preserving release API authentication and tag publishing.
Changes:
- Disables credential persistence in the
releasejob while retaining full Git history. - Regenerates the compiled workflow and associated metadata.
- Adds regression checks for checkout credentials and authentication in both source and compiled jobs.
| File | Description |
|---|---|
scripts/release-workflows.test.cjs |
Adds credential and authentication regression checks. |
.github/workflows/release.md |
Disables credential persistence for the release checkout. |
.github/workflows/release.lock.yml |
Carries the checkout change into the executable workflow. |
Review effort: Max
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: true | ||
| persist-credentials: false |
|
🎉 This pull request is included in a new release. Release: |
The release job retains checkout credentials even though it only reads local Git history and authenticates release API calls through
GH_TOKEN. Disable unnecessary persistence in that job while preserving full history and the separatepush_tagjob's authentication forgit push.Regenerates the release lock file and adds a regression check covering both authored and compiled jobs. No linter suppressions or external workflow changes are included.
Validation: The targeted regression passes and all 348 workflows compile. The required
make agent-report-progressgate passes build, schema freshness, and changed-lock metadata checks, but remains blocked by drift in 27 unrelated, unchanged workflow lock files. Those files were left untouched.