What shipped
PR #52 was merged at 2026-09-09T09:00:03Z carrying an unfixed CWE-522 finding.
This is not a regression introduced by that PR — the finding pre-existed it — but
the PR was the vehicle that was supposed to fix it, and the fix did not land.
Measured on main after the merge
.github/workflows/anchor-drift.yml has five actions/checkout steps and zero
persist-credentials lines, so all five fall back to the default
persist-credentials: true.
Verified against a positive control rather than by absence alone: the prepared
fix patch greps 6 occurrences of persist-credentials; main greps 0.
Why the fix is not in the PR
The fix commit 6a5d1a7 exists but was rejected at push time:
! [remote rejected] (refusing to allow an OAuth App to create or update workflow
'.github/workflows/anchor-drift.yml' without 'workflow' scope)
The acting token carries scopes gist, read:org, repo — no workflow. The
rejection is per-commit and fails the whole push, so the validator commit
bc16497 landed while the workflow commit did not. That asymmetry is why the PR
looked complete.
The fix
Preserved as a patch at:
developer/archive/2026-09-08-drain/merge-run-2026-09-09/pending-patches/0002-ci-anchor-drift-stop-persisting-credentials-on-check.patch
It adds to each checkout step:
with:
# No job here pushes or uses the token; this workflow runs on
# pull_request and executes repository-controlled code, so the
# default credential persistence in .git/config is exposure with
# no upside (CWE-522).
persist-credentials: falseUnblocking
One owner command: gh auth refresh -h github.com -s workflow
The same missing scope also blocks two CWE-522 findings and one
permissions: read-all finding (githubactions:S8234) on hyperpolymath/a2ml#3
— where that last one is the sole cause of a red SonarCloud quality gate.
🤖 Generated with Claude Code
https://claude.ai/code/session_01QNjWX2B4FffG7zqMBMui6v
What shipped
PR #52 was merged at 2026-09-09T09:00:03Z carrying an unfixed CWE-522 finding.
This is not a regression introduced by that PR — the finding pre-existed it — but
the PR was the vehicle that was supposed to fix it, and the fix did not land.
Measured on
mainafter the merge.github/workflows/anchor-drift.ymlhas fiveactions/checkoutsteps and zeropersist-credentialslines, so all five fall back to the defaultpersist-credentials: true.Verified against a positive control rather than by absence alone: the prepared
fix patch greps 6 occurrences of
persist-credentials;maingreps 0.Why the fix is not in the PR
The fix commit
6a5d1a7exists but was rejected at push time:The acting token carries scopes
gist, read:org, repo— noworkflow. Therejection is per-commit and fails the whole push, so the validator commit
bc16497landed while the workflow commit did not. That asymmetry is why the PRlooked complete.
The fix
Preserved as a patch at:
It adds to each checkout step:
Unblocking
One owner command:
gh auth refresh -h github.com -s workflowThe same missing scope also blocks two CWE-522 findings and one
permissions: read-allfinding (githubactions:S8234) onhyperpolymath/a2ml#3— where that last one is the sole cause of a red SonarCloud quality gate.
🤖 Generated with Claude Code
https://claude.ai/code/session_01QNjWX2B4FffG7zqMBMui6v