From cb550968a361a7d2cff7d437cc9c8060cc749093 Mon Sep 17 00:00:00 2001 From: jnasbyupgrade Date: Fri, 7 Aug 2026 18:57:55 -0500 Subject: [PATCH] CI: restore persist-credentials: false on claude-code-review.yml's checkout step The fork-checkout fix (removing the repository:/ref: override so this step checks out the base branch instead of an untrusted PR ref) was applied by deleting the whole with: block under actions/checkout, which also silently dropped persist-credentials: false. This job's permissions include pull-requests: write, a real write-capable credential; nothing here legitimately runs git push (review comments post via the API/ claude-code-action, not git), so there's no reason to leave that credential sitting in .git/config for the rest of the job to misuse if anything later goes wrong. --- .github/workflows/claude-code-review.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index f8aff0a..15c30e7 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -109,6 +109,14 @@ jobs: # Intentionally tracks the major-version tag (not a pinned SHA) so # upstream fixes are picked up automatically. uses: actions/checkout@v7 + with: + # This job's permissions include pull-requests: write, a real + # write-capable credential -- nothing here legitimately runs `git + # push` (review comments post via the API/claude-code-action, not + # git), so there's no reason to leave that credential sitting in + # .git/config for the rest of the job to misuse if anything later + # goes wrong. + persist-credentials: false - name: Run Claude Code Review if: steps.gate.outputs.decision == 'run'