From 0e6718d7518dbd852f3a4a8bafd81f3c9c34e656 Mon Sep 17 00:00:00 2001 From: Leander Furumo Date: Wed, 4 Nov 2026 03:48:00 +0100 Subject: [PATCH] fix(ci): keep the checkout token out of the published image actions/checkout@v5 stored the job's GitHub token in .git/config, and the image copies .git, so published images contained it. Use checkout v7 with persist-credentials: false. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-please.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index b9d0d0d..53404cf 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -32,7 +32,9 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: docker/login-action@v3 with: