Always Set persist-credentials: false in actions/checkout
There's a default in actions/checkout\ that most teams never change — and that quietly leaves a GitHub token sitting in a readable file for every subsequent step in the job. The fix is one line. The reasoning is worth understanding. The Setting - uses : actions/checkout@v4 with : persist-credentials : false # default is true ~~~ By default (\`persist-credentials : true \`), the checkout action…
When using the actions/checkout action in GitHub workflows, it is recommended to set persist-credentials to false. By default, the action writes a git credential configuration file containing your GitHub token to $RUNNER_TEMP. This file persists for the duration of the job. The Base64 string in the file decodes to x-access-token: GITHUB_TOKEN, which is not encrypted or write-protected and is accessible by any subsequent step in the job.
This can pose a significant security risk, as any step in the job, including those from third-party repositories, can extract the token using a simple shell command. Setting persist-credentials to false ensures that the credentials file is deleted after checkout completes, eliminating the file-based exfiltration path. If git authentication is required in later steps, it is recommended to use the gh auth setup-git command, which configures Git to use the GitHub CLI credential helper.
This approach avoids writing the token to disk and scopes it to the steps where GH_TOKEN is explicitly passed in the environment. It is also advised to pin the actions by commit SHA rather than using mutable tags to prevent supply chain attacks. Using static analysis tools like zizmor, ghasec, or ghalint in CI can help detect workflows that do not set persist-credentials to false.
Pinning actions to specific commit SHAs instead of mutable tags can help mitigate the risk of compromised releases.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
