mirror of
https://github.com/element-hq/synapse.git
synced 2026-08-17 08:50:57 +00:00
Andrew Morgan
dd49959ed6
Set actions/checkout persist-credentials: false across jobs that only need a read-only working tree. This keeps the repository token out of local git config and prevents it from being carried into later steps or uploaded artifacts. Switch GitHub Actions caches used by untrusted or artifact-producing jobs to lookup-only, and disable setup-go caching where zizmor flagged cache poisoning risk. These jobs still restore dependency state where useful but do not write new cache entries from those runs. Keep an explicit artipacked suppression on the manual lint-fix workflow because its final git-auto-commit step intentionally needs checkout credentials to push the generated fix commit.