Backport workflow-hardening fix (artipacked) to 5 release branches
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3k
- Forks
- 410
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 78
Description
Summary
The default branch already hardened .github/workflows/nightlies.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.
What's flagged (by zizmor)
artipacked—actions/checkoutleftpersist-credentialsenabled (token leaks into artifacts)
Already resolved on the default branch in:
Affected release branches (5)
release/ngc/26.07(still present as of HEADe6afd573)release/2.13(still present as of HEAD4c9c739b)release/2.12(still present as of HEAD92bb1663)release/ngc/26.06(still present as of HEADbec6f242)release/ngc/26.05(still present as of HEADc4ec0839)
Suggested per-branch patches
Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)
release/ngc/26.07 — artipacked
File .github/workflows/nightlies.yml; suggested edits:
-
- jobs.$J.steps[uses=actions/checkout].with.persist-credentials = False
--- a/.github/workflows/nightlies.yml
+++ b/.github/workflows/nightlies.yml
@@ -15,6 +15,7 @@
with:
ref: main
token: ${{ secrets.GH_PYTORCHBOT_TOKEN }}
+ persist-credentials: false
- name: Create nightly commit
shell: bash
run: |
release/2.13 — artipacked
File .github/workflows/nightlies.yml; suggested edits:
-
- jobs.$J.steps[uses=actions/checkout].with.persist-credentials = False
--- a/.github/workflows/nightlies.yml
+++ b/.github/workflows/nightlies.yml
@@ -15,6 +15,7 @@
with:
ref: main
token: ${{ secrets.GH_PYTORCHBOT_TOKEN }}
+ persist-credentials: false
- name: Create nightly commit
shell: bash
run: |
release/2.12 — artipacked
File .github/workflows/nightlies.yml; suggested edits:
-
- jobs.$J.steps[uses=actions/checkout].with.persist-credentials = False
--- a/.github/workflows/nightlies.yml
+++ b/.github/workflows/nightlies.yml
@@ -15,6 +15,7 @@
with:
ref: main
token: ${{ secrets.GH_PYTORCHBOT_TOKEN }}
+ persist-credentials: false
- name: Create nightly commit
shell: bash
run: |
release/ngc/26.06 — artipacked
File .github/workflows/nightlies.yml; suggested edits:
-
- jobs.$J.steps[uses=actions/checkout].with.persist-credentials = False
--- a/.github/workflows/nightlies.yml
+++ b/.github/workflows/nightlies.yml
@@ -15,6 +15,7 @@
with:
ref: main
token: ${{ secrets.GH_PYTORCHBOT_TOKEN }}
+ persist-credentials: false
- name: Create nightly commit
shell: bash
run: |
release/ngc/26.05 — artipacked
File .github/workflows/nightlies.yml; suggested edits:
-
- jobs.$J.steps[uses=actions/checkout].with.persist-credentials = False
--- a/.github/workflows/nightlies.yml
+++ b/.github/workflows/nightlies.yml
@@ -15,6 +15,7 @@
with:
ref: main
token: ${{ secrets.GH_PYTORCHBOT_TOKEN }}
+ persist-credentials: false
- name: Create nightly commit
shell: bash
run: |
Happy to open pull requests instead if that's preferred.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review .github/workflows/nightlies.yml on each of the five listed release branches, comparing it with the default-branch commit 60f5dfad. Run zizmor and actionlint against the affected workflow entries; done means the artipacked finding is cleared on all five branches without new findings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, yaml
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100