From da56eb2c1943ae022b309e4fc49d3fc2778ce684 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Sun, 19 Apr 2026 20:58:26 +0200 Subject: [PATCH] Stop over-claiming the persist-credentials mechanism MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous comment claimed `git push` reads the token via a git credential helper wired into $RUNNER_TEMP. I don't actually know that's how it works end to end — only that checkout stashes the token there and that subsequent git ops in the same workspace end up authenticating as the PAT. Describe just the observable contract, not an unverified internal path. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/dependabot-dedupe.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/dependabot-dedupe.yml b/.github/workflows/dependabot-dedupe.yml index 40086fb..5707ffe 100644 --- a/.github/workflows/dependabot-dedupe.yml +++ b/.github/workflows/dependabot-dedupe.yml @@ -42,13 +42,13 @@ jobs: - uses: actions/checkout@v6 with: ref: ${{ github.head_ref }} - # With `persist-credentials: true`, checkout stores this token - # in $RUNNER_TEMP and wires a git credential helper that - # supplies it on subsequent HTTPS git calls. That's what makes - # the later `git push` authenticate as the PAT, which in turn - # re-triggers CI on the dedupe commit. `true` is the checkout - # default — made explicit here so the mechanism is visible - # from the YAML instead of implicit in the action. + # With `persist-credentials: true`, this PAT is stashed by the + # action (under $RUNNER_TEMP in recent versions) and made + # available to subsequent git operations in this workspace — + # so the later `git push` authenticates as the PAT, which is + # what gets CI to re-trigger on the dedupe commit. `true` is + # the checkout default; pinned explicitly here because it's + # load-bearing for this workflow. token: ${{ secrets.DEPENDABOT_DEDUPE_TOKEN }} persist-credentials: true - uses: pnpm/action-setup@v6