Require Checkout Steps Not to Persist Credentials - #4171

Summary

actions/checkout writes the job's token into the checkout's git configuration by default, so every later step in the job, and anything it runs, can read a credential it was never handed. Per the maintainer's recorded answer on the issue (option 1), GOVERNANCE.md "Workflow YAML Conventions" gains a "Checkout credentials" rule: every actions/checkout step sets persist-credentials: false, and a job whose later step runs an authenticated git command against the remote keeps it with persist-credentials: true and a comment naming that step.

The hub workflows and the release-with-smoke caller snippet (with its documented copy in docs/reusable-workflows.md) are swept to match.

Per-job audit

Set to false, since no later step needs git authentication:

• build-docker-task.yml: docker-prepare, docker-build-base, build-docker. The build context is a local path.
• build-release-task.yml: dotnet-publish, build-nuget, build-pypi, build-release-asset.
• deploy-site-task.yml: deploy. The deploy goes over SSH/rsync, not git, and the generator reads history locally.
• get-version-task.yml: get-version. NBGV reads local history only.
• publish-docker-readme-task.yml: get-repos, publish-readme.
• validate-task.yml: lint, unit-test, validate. The prose gate's retry git fetch runs only when its base does not resolve, and in this caller the base is HEAD^1 of the pull request merge checkout, which is always local.
• check-upstream-version-task.yml and run-codegen-pull-request-task.yml: peter-evans/create-pull-request configures its own HTTPS credential from its token input (gitConfigHelper.configureToken(inputs.branchToken) at the pinned SHA), so it does not read the persisted one. The checkout keeps its token: input for its own fetch.

Kept with persist-credentials: true and an inline reason:

• build-release-task.yml github-release: the "Supersede a release the token cannot tag step" runs git fetch and git ls-remote against origin.

The release-with-smoke caller snippet's changes job (and its copy in docs/reusable-workflows.md) sets false too. Its "Filter changed paths step" now runs only on a pull_request event, where dorny/paths-filter reads the changed files from the API. On a dispatch it would have fetched the base branch with git for an output smoke-build ignores on a dispatch anyway, and an empty output there is what the doc's dispatch-bypass note already expects.

Already compliant and unchanged: canonical-review-sweep.yml, test-pull-request.yml.

Adopter hooks the tasks run (./.github/actions/*) were checked with a code search across the owner's repositories for git fetch, git push, git ls-remote, git pull, and git clone. The one hit is a public repository's validate hook, whose fetch works anonymously and falls back safely when it fails. docs/reusable-workflows.md "The Hook Contract" now states that a hook runs with no persisted git credential.

scripts/build_dist.py --check reports the generated skill distributions current, so no skill include carries this section.

The new comment lines are owed by the rule itself, so this pull request carries the comments label.

Closes on promotion: #1650

🤖 Generated with Claude Code

Summary by CodeRabbit

• Security
  • Checkout credentials are no longer persisted by default across build, release, validation, and deployment workflows. Steps that require authenticated Git access retain credentials explicitly.
  • Workflow hooks that access remotes must provide their own credentials.
• Documentation
  • Updated workflow guidance and examples to reflect credential handling and to run changed-path filtering only for pull request events.