Set persist-credentials: false on actions/checkout

Posted By on October 18, 2026

By default, actions/checkout persists its auth token so later git commands in the job are authenticated. The actions/checkout README: “The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set `persist-credentials: false` to opt-out.” Since Checkout v6 the credentials live in a separate file under $RUNNER_TEMP instead of directly in .git/config, but they are still there for the rest of the job.

Fix: if the job never needs to git push, opt out on the checkout step:
– uses: actions/checkout@v7
with:
persist-credentials: false
Jobs that do push with the checkout token need the default. persist-credentials only controls what checkout leaves in git config; still keep GITHUB_TOKEN permissions minimal (GitHub Docs: “To help mitigate the risk of an exposed token, consider restricting the assigned permissions.”).

OWASP CICD-SEC-6 (Insufficient Credential Hygiene) recommends: “Ensure secrets that are used in CI/CD systems are scoped in a manner that allows each pipeline and step to have access to only the secrets it requires.”

Also new in Checkout v7: it refuses to check out fork pull request code by default in pull_request_target and workflow_run workflows (opt-in input: allow-unsafe-pr-checkout).

Fictional acme-lab examples only. Defensive education — no real systems, no secrets.

Sources:
actions/checkout README: https://github.com/actions/checkout
actions/checkout CHANGELOG: https://github.com/actions/checkout/blob/main/CHANGELOG.md
GitHub Docs, Secure use reference: https://docs.github.com/en/actions/reference/security/secure-use
GitHub Changelog, Safer pull_request_target defaults for actions/checkout: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
OWASP Top 10 CI/CD Security Risks — CICD-SEC-6 Insufficient Credential Hygiene: https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-06-Insufficient-Credential-Hygiene

Full lab — GitHub Actions PPE Lab: The pull_request_target Mistake (and the YAML Fix): https://www.youtube.com/watch?v=qu37BYFrHug
Narration uses an AI-generated voice.
#Shorts #GitHubActions #DevSecOps #CICDSecurity #SupplyChainSecurity