From 4d5cdd89eda9a1e9677ab0ff4f2c37eb9855215a Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 9 Sep 2026 09:39:41 +0100
Subject: [PATCH] ci(anchor-drift): stop persisting credentials on checkout
 (CWE-522)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workflow triggers on pull_request and every job runs repository-controlled
code (scripts/, conformance/, validate-a2ml.sh from the PR ref). checkout
leaves the token in .git/config by default, so that code runs beside a usable
credential.

No job in this workflow pushes, commits, or reads GITHUB_TOKEN/secrets — the
grep is empty — so persistence buys nothing and is pure exposure. Applied to
all six checkouts rather than only the one flagged: it is the same defect at
each, and leaving five would just be five findings waiting to be filed.

Job permissions were already minimal at the top level (actions: read,
contents: read) and are left as they are.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QNjWX2B4FffG7zqMBMui6v
---
 .github/workflows/anchor-drift.yml | 36 ++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/.github/workflows/anchor-drift.yml b/.github/workflows/anchor-drift.yml
index 9d57d0c..b8a9bf6 100644
--- a/.github/workflows/anchor-drift.yml
+++ b/.github/workflows/anchor-drift.yml
@@ -22,6 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - name: Check membership manifest and submodule declarations
         run: scripts/check-membership.sh
       - name: Resolve submodule pins
@@ -52,6 +58,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - name: Check upstream spec and governance pins
         run: |
           anchor=".machine_readable/anchors/ANCHOR.a2ml"
@@ -69,6 +81,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79
         with:
           path: "."
@@ -88,6 +106,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79
         with:
           path: "conformance/valid"
@@ -97,6 +121,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - id: negative
         continue-on-error: true
         uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79
@@ -118,5 +148,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - name: Deed fixtures — all four ruled heads
         run: bash conformance/run-deed-tests.sh