(ignore) Harden actions/checkout: persist-credentials: false in codeql & dependency-review - #1731
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dina Berry (MSFT) (diberry)
left a comment
Dina Berry (MSFT) (diberry)
left a comment
There was a problem hiding this comment.
Advisory security review by Statler (project-dina squad): I verified this PR only adds with: persist-credentials: false to the actions/checkout steps in .github/workflows/codeql.yml and .github/workflows/dependency-review.yml.
This correctly implements the audit recommendation. It is a no-behavior-change hardening that prevents the workflow GITHUB_TOKEN from persisting in the PR worktree.
✅ Advisory: approve — safe to merge.
Note: a human collaborator approval is still required to satisfy branch protection.
There was a problem hiding this comment.
Pull request overview
This pull request hardens the repository’s GitHub Actions security posture by ensuring actions/checkout does not persist GITHUB_TOKEN credentials into the checked-out workspace for the CodeQL and Dependency Review workflows.
Changes:
- Set
persist-credentials: falseonactions/checkoutin the Dependency Review workflow. - Set
persist-credentials: falseonactions/checkoutin the CodeQL workflow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/dependency-review.yml | Disables persisted checkout credentials for the dependency review job to reduce token exposure in the workspace. |
| .github/workflows/codeql.yml | Disables persisted checkout credentials for CodeQL analysis runs to reduce token exposure in the workspace. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
a966296
into
Azure-Samples:main
Summary
Hardens two GitHub Actions workflows by setting
persist-credentials: falseon theiractions/checkoutsteps, soGITHUB_TOKENis not persisted into the PR worktree.Files changed:
.github/workflows/codeql.yml.github/workflows/dependency-review.ymlThis follows the prior read-only audit recommendation recorded at
C:\project-dina-ai-dev-tools\projects\azure-ai-tools\reports\research-2026-07-16-0958-azure-typescript-e2e-apps-workflow-secrets.md.No behavior change is intended beyond reducing token exposure in the checked-out workspace.