ci: actions/checkout with persist-credentials false

Rust Bitcoin/rust-bitcoin

bbe1b79b View source ↗

Public commit record

What the developer wrote

Authored by Jose Storopoli

62/100 · Adequate

ci: actions/checkout with persist-credentials false

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit changes the project's GitHub Actions CI workflows so that after checking out the source code, the temporary GitHub authentication token is no longer kept in memory for later steps. This is a defensive hardening change: it reduces the risk that a compromised third-party action or malicious build step could steal the token and modify the repository or release artifacts. It does not fix an active bug in the Bitcoin library code itself.

Recommended action

Review whether any workflow step legitimately needs the checkout-persisted token after this change; if not, the patch is safe to merge. Consider also using narrowly-scoped permissions at the workflow/job level and OIDC-based publishing for release jobs as follow-up hardening. No immediate action is required for downstream users of the rust-bitcoin crate.

Security signals we found

Hardens CI/CD supply-chain surface by removing persistent GitHub tokens after checkout

Mitigates token exfiltration by compromised third-party actions or build dependencies

Reduces blast radius of workflow-level compromise for release and cron jobs

No change to library code, cryptography, or consensus logic

Technical analysis

Evidence from the diff

The patch adds persist-credentials: false to every actions/checkout invocation across the project’s GitHub Actions workflows and to the shell script that generates the fuzz workflow. By default, actions/checkout leaves a short-lived GITHUB_TOKEN in the local Git config and environment, which subsequent steps can use to push commits, create releases, or perform other repository operations. Setting persist-credentials: false causes the action to remove that token after checkout, limiting the window in which a malicious or compromised later step can exfiltrate or abuse it. The change is purely CI hardening and does not alter the rust-bitcoin library code, its APIs, or its cryptographic behavior.

Changed components

.github/workflows/cron-daily-fuzz.yml.github/workflows/cron-daily-kani.yml.github/workflows/cron-weekly-cargo-mutants.yml.github/workflows/cron-weekly-rustfmt.yml.github/workflows/cron-weekly-update-cargo-semver-checks.yml.github/workflows/cron-weekly-update-nightly.yml.github/workflows/cron-weekly-update-stable.yml.github/workflows/gh-release.yml.github/workflows/manage-pr.yml.github/workflows/miri.yml.github/workflows/release.yml.github/workflows/rust.yml.github/workflows/semver-checks.yml.github/workflows/shellcheck.ymlfuzz/generate-files.sh

Inspect captured patch +74 / −0

diff --git a/.github/workflows/cron-daily-fuzz.yml b/.github/workflows/cron-daily-fuzz.yml
index 532ae1c7..24b268a5 100644
--- a/.github/workflows/cron-daily-fuzz.yml
+++ b/.github/workflows/cron-daily-fuzz.yml
@@ -48,6 +48,8 @@ jobs:
       - name: Install test dependencies
         run: sudo apt-get update -y && sudo apt-get install -y binutils-dev libunwind8-dev libcurl4-openssl-dev libelf-dev libdw-dev cmake gcc libiberty-dev
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         id: cache-fuzz
         with:
@@ -78,6 +80,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
       - name: Display structure of downloaded files
         run: ls -R
diff --git a/.github/workflows/cron-daily-kani.yml b/.github/workflows/cron-daily-kani.yml
index 4e4dfde1..e872532b 100644
--- a/.github/workflows/cron-daily-kani.yml
+++ b/.github/workflows/cron-daily-kani.yml
@@ -9,6 +9,8 @@ jobs:
     steps:
       - name: 'Checkout your code.'
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: 'Run Kani on your code.'
         uses: model-checking/kani-github-action@f838096619a707b0f6b2118cf435eaccfa33e51f # v1.1
diff --git a/.github/workflows/cron-weekly-cargo-mutants.yml b/.github/workflows/cron-weekly-cargo-mutants.yml
index 9700299b..cdc67934 100644
--- a/.github/workflows/cron-weekly-cargo-mutants.yml
+++ b/.github/workflows/cron-weekly-cargo-mutants.yml
@@ -8,6 +8,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: taiki-e/install-action@81ee1d48d9194cdcab880cbdc7d36e87d39874cb # v2.62.45
         with:
           tool: cargo-mutants
diff --git a/.github/workflows/cron-weekly-rustfmt.yml b/.github/workflows/cron-weekly-rustfmt.yml
index 380b2bf8..5160be64 100644
--- a/.github/workflows/cron-weekly-rustfmt.yml
+++ b/.github/workflows/cron-weekly-rustfmt.yml
@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@55d80eb3c5a4228eec5390a083c092095115c6f1 # nightly
         with:
           components: rustfmt
diff --git a/.github/workflows/cron-weekly-update-cargo-semver-checks.yml b/.github/workflows/cron-weekly-update-cargo-semver-checks.yml
index fd9cd2ef..0bee1f2f 100644
--- a/.github/workflows/cron-weekly-update-cargo-semver-checks.yml
+++ b/.github/workflows/cron-weekly-update-cargo-semver-checks.yml
@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: Update semver-checks to use latest crates.io published version
         run: |
           set -x
diff --git a/.github/workflows/cron-weekly-update-nightly.yml b/.github/workflows/cron-weekly-update-nightly.yml
index 5c147488..ad893498 100644
--- a/.github/workflows/cron-weekly-update-nightly.yml
+++ b/.github/workflows/cron-weekly-update-nightly.yml
@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@55d80eb3c5a4228eec5390a083c092095115c6f1 # nightly
       - name: Update rust.yml to use latest nightly
         run: |
diff --git a/.github/workflows/cron-weekly-update-stable.yml b/.github/workflows/cron-weekly-update-stable.yml
index b93595e9..e406411f 100644
--- a/.github/workflows/cron-weekly-update-stable.yml
+++ b/.github/workflows/cron-weekly-update-stable.yml
@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: Update semver-checks.yml to use latest stable
         run: |
diff --git a/.github/workflows/gh-release.yml b/.github/workflows/gh-release.yml
index e3581138..2c70ec0a 100644
--- a/.github/workflows/gh-release.yml
+++ b/.github/workflows/gh-release.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
       with:
         generateReleaseNotes: true
diff --git a/.github/workflows/manage-pr.yml b/.github/workflows/manage-pr.yml
index d7b660fb..c87685dd 100644
--- a/.github/workflows/manage-pr.yml
+++ b/.github/workflows/manage-pr.yml
@@ -13,11 +13,13 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: master
+          persist-credentials: false
       - name: Checkout merge commit
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: merge
           ref: "refs/pull/${{ github.event.number }}/merge"
+          persist-credentials: false
       - name: Generate label config
         run: cd master && SCAN_DIR=../merge ./contrib/gen_label_config.sh
       - name: Update labels
diff --git a/.github/workflows/miri.yml b/.github/workflows/miri.yml
index 8eb9a352..b9238783 100644
--- a/.github/workflows/miri.yml
+++ b/.github/workflows/miri.yml
@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Read nightly version"
         id: read_toolchain
         run: echo "nightly_version=$(cat nightly-version)" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 27f7410b..78458669 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Checkout Crate
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: Checkout Toolchain
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: run cargo
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index dcf7e4d3..43179b82 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Read workspace versions"
         id: read_toolchain
         run: |
@@ -34,12 +36,15 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Checkout maintainer tools"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: rust-bitcoin/rust-bitcoin-maintainer-tools
           ref: ${{ needs.Prepare.outputs.maintainer_tools_version }}
           path: maintainer-tools
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Set dependencies"
@@ -58,12 +63,15 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Checkout maintainer tools"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: rust-bitcoin/rust-bitcoin-maintainer-tools
           ref: ${{ needs.Prepare.outputs.maintainer_tools_version }}
           path: maintainer-tools
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
@@ -84,12 +92,15 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Checkout maintainer tools"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: rust-bitcoin/rust-bitcoin-maintainer-tools
           ref: ${{ needs.Prepare.outputs.maintainer_tools_version }}
           path: maintainer-tools
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
         with:
@@ -110,12 +121,15 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Checkout maintainer tools"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: rust-bitcoin/rust-bitcoin-maintainer-tools
           ref: ${{ needs.Prepare.outputs.maintainer_tools_version }}
           path: maintainer-tools
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
@@ -138,12 +152,15 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Checkout maintainer tools"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: rust-bitcoin/rust-bitcoin-maintainer-tools
           ref: ${{ needs.Prepare.outputs.maintainer_tools_version }}
           path: maintainer-tools
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Set dependencies"
@@ -162,12 +179,15 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Checkout maintainer tools"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: rust-bitcoin/rust-bitcoin-maintainer-tools
           ref: ${{ needs.Prepare.outputs.maintainer_tools_version }}
           path: maintainer-tools
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
@@ -188,12 +208,15 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Checkout maintainer tools"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: rust-bitcoin/rust-bitcoin-maintainer-tools
           ref: ${{ needs.Prepare.outputs.maintainer_tools_version }}
           path: maintainer-tools
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
@@ -209,6 +232,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Add architecture i386"
@@ -227,6 +252,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Install target"
@@ -246,6 +273,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Set up QEMU"
         run: sudo apt update && sudo apt install -y qemu-system-arm gcc-arm-none-eabi
       - name: "Select toolchain"
@@ -275,6 +304,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
@@ -295,6 +326,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Run wasm script"
@@ -306,6 +339,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Build Kani proofs"
         uses: model-checking/kani-github-action@f838096619a707b0f6b2118cf435eaccfa33e51f # v1.1
         with:
@@ -322,6 +357,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
@@ -341,6 +378,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Run policy script"
@@ -354,6 +393,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Run API checker script"
diff --git a/.github/workflows/semver-checks.yml b/.github/workflows/semver-checks.yml
index 434a267f..6434a8f1 100644
--- a/.github/workflows/semver-checks.yml
+++ b/.github/workflows/semver-checks.yml
@@ -14,6 +14,7 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0 # we need full history for cargo semver-checks
+          persist-credentials: false
       - name: "Install Rustup"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Select stable-version"
@@ -51,6 +52,8 @@ jobs:
     steps:
       - name: "Checkout repo"
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: "Install Rustup"
         uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
       - name: "Select stable-version"
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 97b51a17..ba4f9f03 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: Run ShellCheck
       uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
       env:
diff --git a/fuzz/generate-files.sh b/fuzz/generate-files.sh
index 102d8e00..896fbd7d 100755
--- a/fuzz/generate-files.sh
+++ b/fuzz/generate-files.sh
@@ -72,6 +72,8 @@ $(for name in $(listTargetNames); do echo "          $name,"; done)
       - name: Install test dependencies
         run: sudo apt-get update -y && sudo apt-get install -y binutils-dev libunwind8-dev libcurl4-openssl-dev libelf-dev libdw-dev cmake gcc libiberty-dev
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
 
         id: cache-fuzz
@@ -103,6 +105,8 @@ $(for name in $(listTargetNames); do echo "          $name,"; done)
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
       - name: Display structure of downloaded files
         run: ls -R

Risk score

Why this scored 42/100

Our methodology →

Potential impact 8/30

Exploitability 6/25

Stealth signal 10/15

Affected reach 7/15

Confidence 7/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 42/100

Community notes

Related watches

taproot-primitives: Implement encoding traits for TapLeafHash

Split Address into an extension trait

refactor(bip32): Xpub child tweak api