From aa574c114f3301f42648128fecbe83219aadf881 Mon Sep 17 00:00:00 2001 From: "Dina Berry (MSFT)" Date: Thu, 16 Jul 2026 10:04:56 -0700 Subject: [PATCH 1/2] Harden checkout credentials in .github/workflows/codeql.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e5ffff22..9f5a7f15 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -50,6 +50,8 @@ jobs: - name: Checkout repository uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL From 046b7f1be19592f94b719b28d148c6f23036588b Mon Sep 17 00:00:00 2001 From: "Dina Berry (MSFT)" Date: Thu, 16 Jul 2026 10:04:57 -0700 Subject: [PATCH 2/2] Harden checkout credentials in .github/workflows/dependency-review.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/dependency-review.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index f072eaba..4e5b360e 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -23,5 +23,7 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + persist-credentials: false - name: 'Dependency Review' uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4