Djeex/adguard-cidre
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Releases 8 Activity

Prevent actions/checkout's ephemeral credential from overriding the bot push token
CI / build-and-scan (push) Successful in 1m29s
Details

Browse Source
This commit is contained in:
Djeex
2026-08-22 15:39:28 +02:00
parent 1f0a664a4f
commit f144c88c7c
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+7
View File
@@ -16,6 +16,7 @@ jobs:
uses: actions/checkout@v7 uses: actions/checkout@v7
with: with:
fetch-depth: 0 fetch-depth: 0
persist-credentials: false
- name: Build Docker image - name: Build Docker image
run: | run: |
@@ -95,6 +96,12 @@ jobs:
git add VERSION git add VERSION
git commit -m "Bump build version to $NEW_VERSION [skip ci]" git commit -m "Bump build version to $NEW_VERSION [skip ci]"
# Belt and suspenders: actions/checkout can leave its own ephemeral
# credential injected as an extraheader, which would silently override
# the URL-embedded token below. persist-credentials:false on checkout
# should already prevent this, but strip it here too just in case.
git config --unset-all http.https://git.djeex.fr/.extraheader || true
git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/adguard-cidre.git" HEAD:main git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/adguard-cidre.git" HEAD:main
fi fi