From ebf7cac68ab4eccffe5ca09950ee95be531d2bf9 Mon Sep 17 00:00:00 2001
From: Mynacol <git@mynacol.xyz>
Date: Sat, 15 Aug 2026 22:19:00 +0000
Subject: [PATCH] CI: Avoid persisting git credentials

Following zizmor recommendations. The prhtmlupload workflow needs the
credentials to push git commits at the end.
---
 .github/workflows/lint.yml            | 6 ++++++
 .github/workflows/prhtmlgenerator.yml | 2 ++
 .github/workflows/tests.yml           | 2 ++
 3 files changed, 10 insertions(+)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b0fcde905d7..b88ac82c4a7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -17,6 +17,8 @@ jobs:
         php-versions: ['7.4']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
@@ -30,6 +32,8 @@ jobs:
         php-versions: ['7.4']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
@@ -41,6 +45,8 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - run: |
           if find -name "*.php" -executable -type f -print -exec false {} +
           then
diff --git a/.github/workflows/prhtmlgenerator.yml b/.github/workflows/prhtmlgenerator.yml
index da7c3ddcacf..45a7e1361ea 100644
--- a/.github/workflows/prhtmlgenerator.yml
+++ b/.github/workflows/prhtmlgenerator.yml
@@ -28,6 +28,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           path: pr
+          persist-credentials: false
       - name: Build docker image - PR
         if: steps.configuration.outputs.number_bridges > 0
         run: docker build -t rss-bridge-pr pr/
@@ -42,6 +43,7 @@ jobs:
           ref: ${{github.event.pull_request.base.ref}}
           repository: ${{github.event.pull_request.base.repo.full_name}}
           path: current
+          persist-credentials: false
       - name: Build docker image - Current
         if: steps.configuration.outputs.number_bridges > 0
         run: docker build -t rss-bridge-current current/
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 8a910a1838d..6bd2968b3d8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -17,6 +17,8 @@ jobs:
         php-versions: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}