Merge pull request #300 from faster-cpython/dont-persist-credentials

Based on zizmor linting: Don't persist credentials when not necessary

Author: mdboom

bench_runner/templates/_benchmark.src.yml

@@ -77,6 +77,7 @@ jobs:
       - name: Checkout CPython
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: ${{ inputs.fork }}/cpython
           path: cpython
           ref: ${{ inputs.ref }}
@@ -96,13 +97,15 @@ jobs:
         uses: actions/checkout@v4
         if: ${{ steps.should_run.outputs.should_run != 'false' }}
         with:
+          persist-credentials: false
           repository: pyston/python-macrobenchmarks
           path: pyston-benchmarks
           ref: ${{ env.PYSTON_BENCHMARKS_HASH }}
       - name: Checkout pyperformance
         uses: actions/checkout@v4
         if: ${{ steps.should_run.outputs.should_run != 'false' }}
         with:
+          persist-credentials: false
           repository: mdboom/pyperformance
           path: pyperformance
           ref: ${{ env.PYPERFORMANCE_HASH }}
@@ -163,6 +166,7 @@ jobs:
       - name: Checkout CPython
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: ${{ inputs.fork }}/cpython
           path: cpython
           ref: ${{ inputs.ref }}
@@ -182,13 +186,15 @@ jobs:
         uses: actions/checkout@v4
         if: ${{ steps.should_run.outputs.should_run != 'false' }}
         with:
+          persist-credentials: false
           repository: pyston/python-macrobenchmarks
           path: pyston-benchmarks
           ref: ${{ env.PYSTON_BENCHMARKS_HASH }}
       - name: Checkout pyperformance
         uses: actions/checkout@v4
         if: ${{ steps.should_run.outputs.should_run != 'false' }}
         with:
+          persist-credentials: false
           repository: mdboom/pyperformance
           path: pyperformance
           ref: ${{ env.PYPERFORMANCE_HASH }}
@@ -257,6 +263,7 @@ jobs:
       - name: Checkout CPython
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: ${{ inputs.fork }}/cpython
           path: cpython
           ref: ${{ inputs.ref }}
@@ -276,13 +283,15 @@ jobs:
         uses: actions/checkout@v4
         if: ${{ steps.should_run.outputs.should_run != 'false' }}
         with:
+          persist-credentials: false
           repository: pyston/python-macrobenchmarks
           path: pyston-benchmarks
           ref: ${{ env.PYSTON_BENCHMARKS_HASH }}
       - name: Checkout pyperformance
         uses: actions/checkout@v4
         if: ${{ steps.should_run.outputs.should_run != 'false' }}
         with:
+          persist-credentials: false
           repository: mdboom/pyperformance
           path: pyperformance
           ref: ${{ env.PYPERFORMANCE_HASH }}

bench_runner/templates/_generate.src.yml

@@ -33,6 +33,7 @@ jobs:
       - name: Checkout CPython
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: python/cpython
           path: cpython
       - name: Setup system Python

bench_runner/templates/_notify.src.yml

@@ -22,6 +22,8 @@ jobs:
       - uses: technote-space/workflow-conclusion-action@v3
       - name: Checkout benchmarking
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup system Python
         uses: actions/setup-python@v5
         with:

bench_runner/templates/_publish.src.yml

@@ -22,6 +22,7 @@ jobs:
       - name: Checkout benchmarking
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           path: private
           ref: main
           fetch-depth: 0

bench_runner/templates/_pystats.src.yml

@@ -59,6 +59,7 @@ jobs:
       - name: Checkout CPython
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: ${{ inputs.fork }}/cpython
           ref: ${{ inputs.ref }}
           path: cpython
@@ -77,13 +78,15 @@ jobs:
         uses: actions/checkout@v4
         if: ${{ steps.should_run.outputs.should_run != 'false' }}
         with:
+          persist-credentials: false
           repository: pyston/python-macrobenchmarks
           path: pyston-benchmarks
           ref: ${{ env.PYSTON_BENCHMARKS_HASH }}
       - name: Checkout pyperformance
         uses: actions/checkout@v4
         if: ${{ steps.should_run.outputs.should_run != 'false' }}
         with:
+          persist-credentials: false
           repository: mdboom/pyperformance
           path: pyperformance
           ref: ${{ env.PYPERFORMANCE_HASH }}

bench_runner/templates/_weekly.src.yml

@@ -18,6 +18,7 @@ jobs:
       - name: Checkout CPython
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: python/cpython
           path: cpython
           ref: main

bench_runner/templates/benchmark.src.yml

@@ -47,6 +47,8 @@ jobs:
     steps:
       - name: Checkout benchmarking
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup system Python
         uses: actions/setup-python@v5
         with:
@@ -55,6 +57,7 @@ jobs:
       - name: Checkout CPython
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: ${{ inputs.fork }}/cpython
           path: cpython
           ref: ${{ inputs.ref }}