[shenxianpeng]

Before: two workflows here left the job token in .git/config after checkout:

• commit-check.yml, which then runs commit-check-action with pull-requests: write;
• the shared pre-commit.yml, which then runs the pre-commit hooks, code from other repositories.

Neither needs authenticated git. Every workflow in the other repositories already checks out with persist-credentials: false; these two were the gaps.

After:

       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # Required for merge-base checks
+          # Nothing after checkout needs authenticated git.
+          persist-credentials: false

and the same for the checkout in pre-commit.yml. The action's own self-test already runs this way, and pre-commit clones its hook repositories itself, without that token. The only caller of pre-commit.yml is commit-check-action, which passes no commands.

Summary by CodeRabbit

• Chores
  • Automated commit checks and pre-commit workflows no longer retain checkout credentials in Git configuration. This changes how credentials are handled during those workflows; it does not affect the app’s features or behavior for end users. The update applies to both automated workflows and leaves their other reported behavior unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9b9c8e9b-55ef-4dc1-86a7-f38e63a5aafd

📥 Commits

Reviewing files that changed from the base of the PR and between b1a801a and f0db6db.

📒 Files selected for processing: 2

• .github/workflows/commit-check.yml
• .github/workflows/pre-commit.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Both GitHub Actions workflows now disable persisted checkout credentials. The commit-check workflow also states that later steps do not need authenticated Git.

Changes: Checkout credential handling

Layer / File(s)	Summary
Workflow checkout configuration .github/workflows/commit-check.yml, .github/workflows/pre-commit.yml	Both checkout steps set persist-credentials: false. The commit-check workflow notes that later steps do not need authenticated Git.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to f0db6

The workflows can merge safely; persisted checkout credentials are removed without affecting reachable steps.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preventing checkout tokens from remaining in .git/config in CI workflows.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Commit Check

✅ All 3 checks passed

Show all 3 checks

Commit message
  ✔ PR title (ci: do not leave the token in .git/config after checkout)
  ✔ Commit 1/1 (f0db6db) (ci: do not leave the token in .git/config after checkout)
Branch
  ✔ Branch (ci/no-persisted-token)

commit-check 2.19.0 · Rules reference