From 32ea0f66f5ab5b944de83878dbc6d67500dddd4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Sun, 19 Apr 2026 20:55:47 +0200 Subject: [PATCH] Make persist-credentials explicit in dedupe checkout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `actions/checkout` has `persist-credentials: true` as its default, but that default is the load-bearing part of how the later `git push` authenticates — it's what writes the token into .git/config's http.extraheader. Making it explicit so a reader of the YAML can see the mechanism without having to know the action's defaults. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/dependabot-dedupe.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-dedupe.yml b/.github/workflows/dependabot-dedupe.yml index bc095d7..902dd6e 100644 --- a/.github/workflows/dependabot-dedupe.yml +++ b/.github/workflows/dependabot-dedupe.yml @@ -44,8 +44,11 @@ jobs: ref: ${{ github.head_ref }} # Persist this token in .git/config's http.extraheader so the # later `git push` authenticates as the PAT. That's what makes - # the dedupe commit trigger CI. + # the dedupe commit trigger CI. `persist-credentials: true` is + # the checkout default — made explicit here so the mechanism + # is visible from the YAML instead of implicit in the action. token: ${{ secrets.DEPENDABOT_DEDUPE_TOKEN }} + persist-credentials: true - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v6 with: