@@ -81,7 +81,8 @@ jobs:
8181ref: ${{ inputs.target_ref || github.sha }}
8282fetch-depth: 1
8383fetch-tags: false
84-persist-credentials: true
84+token: ""
85+persist-credentials: false
8586submodules: false
86878788 - name: Resolve checkout SHA
@@ -304,7 +305,8 @@ jobs:
304305ref: ${{ inputs.target_ref || github.sha }}
305306fetch-depth: 1
306307fetch-tags: false
307-persist-credentials: true
308+token: ""
309+persist-credentials: false
308310submodules: false
309311310312 - name: Ensure security base commit
@@ -335,22 +337,20 @@ jobs:
335337 fi
336338 echo "PRE_COMMIT_CONFIG_PATH=$trusted_config" >> "$GITHUB_ENV"
337339338- - name: Setup Python
340+ - name: Resolve Python runtime
339341id: setup-python
340-uses: actions/setup-python@v6
341-with:
342-python-version: "3.12"
343-344- - name: Restore pre-commit cache
345-uses: actions/cache@v5
346-with:
347-path: .cache/pre-commit-security-fast
348-key: pre-commit-security-fast-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
349-restore-keys: |
350- pre-commit-security-fast-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-
342+run: |
343+ set -euo pipefail
344+ python3 --version
345+ version="$(python3 - <<'PY'
346+ import platform
347+ print(platform.python_version())
348+ PY
349+ )"
350+ echo "python-version=${version}" >> "$GITHUB_OUTPUT"
351351352352 - name: Install pre-commit
353-run: python -m pip install --disable-pip-version-check pre-commit==4.2.0
353+run: python3 -m pip install --disable-pip-version-check pre-commit==4.2.0
354354355355 - name: Detect committed private keys
356356run: pre-commit run --config "${PRE_COMMIT_CONFIG_PATH:-.pre-commit-config.yaml}" --all-files detect-private-key
@@ -411,7 +411,6 @@ jobs:
411411env:
412412CHECKOUT_REPO: ${{ github.repository }}
413413CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
414-CHECKOUT_TOKEN: ${{ github.token }}
415414run: |
416415 set -euo pipefail
417416@@ -427,7 +426,7 @@ jobs:
427426 reset_checkout_dir
428427 git init "$workdir" >/dev/null
429428 git config --global --add safe.directory "$workdir"
430- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
429+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
431430 git -C "$workdir" config gc.auto 0
432431433432 timeout --signal=TERM 30s git -C "$workdir" \
@@ -636,7 +635,6 @@ jobs:
636635env:
637636CHECKOUT_REPO: ${{ github.repository }}
638637CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
639-CHECKOUT_TOKEN: ${{ github.token }}
640638run: |
641639 set -euo pipefail
642640@@ -652,7 +650,7 @@ jobs:
652650 reset_checkout_dir
653651 git init "$workdir" >/dev/null
654652 git config --global --add safe.directory "$workdir"
655- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
653+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
656654 git -C "$workdir" config gc.auto 0
657655658656 timeout --signal=TERM 30s git -C "$workdir" \
@@ -723,7 +721,6 @@ jobs:
723721env:
724722CHECKOUT_REPO: ${{ github.repository }}
725723CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
726-CHECKOUT_TOKEN: ${{ github.token }}
727724run: |
728725 set -euo pipefail
729726@@ -739,7 +736,7 @@ jobs:
739736 reset_checkout_dir
740737 git init "$workdir" >/dev/null
741738 git config --global --add safe.directory "$workdir"
742- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
739+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
743740 git -C "$workdir" config gc.auto 0
744741745742 timeout --signal=TERM 30s git -C "$workdir" \
@@ -804,7 +801,6 @@ jobs:
804801env:
805802CHECKOUT_REPO: ${{ github.repository }}
806803CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
807-CHECKOUT_TOKEN: ${{ github.token }}
808804run: |
809805 set -euo pipefail
810806@@ -820,7 +816,7 @@ jobs:
820816 reset_checkout_dir
821817 git init "$workdir" >/dev/null
822818 git config --global --add safe.directory "$workdir"
823- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
819+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
824820 git -C "$workdir" config gc.auto 0
825821826822 timeout --signal=TERM 30s git -C "$workdir" \
@@ -882,7 +878,6 @@ jobs:
882878env:
883879CHECKOUT_REPO: ${{ github.repository }}
884880CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
885-CHECKOUT_TOKEN: ${{ github.token }}
886881run: |
887882 set -euo pipefail
888883@@ -898,7 +893,7 @@ jobs:
898893 reset_checkout_dir
899894 git init "$workdir" >/dev/null
900895 git config --global --add safe.directory "$workdir"
901- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
896+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
902897 git -C "$workdir" config gc.auto 0
903898904899 timeout --signal=TERM 30s git -C "$workdir" \
@@ -958,7 +953,6 @@ jobs:
958953env:
959954CHECKOUT_REPO: ${{ github.repository }}
960955CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
961-CHECKOUT_TOKEN: ${{ github.token }}
962956run: |
963957 set -euo pipefail
964958@@ -974,7 +968,7 @@ jobs:
974968 reset_checkout_dir
975969 git init "$workdir" >/dev/null
976970 git config --global --add safe.directory "$workdir"
977- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
971+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
978972 git -C "$workdir" config gc.auto 0
979973980974 timeout --signal=TERM 30s git -C "$workdir" \
@@ -1081,7 +1075,6 @@ jobs:
10811075env:
10821076CHECKOUT_REPO: ${{ github.repository }}
10831077CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
1084-CHECKOUT_TOKEN: ${{ github.token }}
10851078run: |
10861079 set -euo pipefail
10871080@@ -1097,7 +1090,7 @@ jobs:
10971090 reset_checkout_dir
10981091 git init "$workdir" >/dev/null
10991092 git config --global --add safe.directory "$workdir"
1100- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
1093+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
11011094 git -C "$workdir" config gc.auto 0
1102109511031096 timeout --signal=TERM 30s git -C "$workdir" \
@@ -1212,7 +1205,6 @@ jobs:
12121205env:
12131206CHECKOUT_REPO: ${{ github.repository }}
12141207CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
1215-CHECKOUT_TOKEN: ${{ github.token }}
12161208run: |
12171209 set -euo pipefail
12181210@@ -1228,7 +1220,7 @@ jobs:
12281220 reset_checkout_dir
12291221 git init "$workdir" >/dev/null
12301222 git config --global --add safe.directory "$workdir"
1231- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
1223+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
12321224 git -C "$workdir" config gc.auto 0
1233122512341226 timeout --signal=TERM 30s git -C "$workdir" \
@@ -1362,7 +1354,6 @@ jobs:
13621354env:
13631355CHECKOUT_REPO: ${{ github.repository }}
13641356CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
1365-CHECKOUT_TOKEN: ${{ github.token }}
13661357run: |
13671358 set -euo pipefail
13681359@@ -1378,7 +1369,7 @@ jobs:
13781369 reset_checkout_dir
13791370 git init "$workdir" >/dev/null
13801371 git config --global --add safe.directory "$workdir"
1381- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
1372+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
13821373 git -C "$workdir" config gc.auto 0
1383137413841375 timeout --signal=TERM 30s git -C "$workdir" \
@@ -1413,7 +1404,8 @@ jobs:
14131404repository: openclaw/clawhub
14141405path: clawhub-source
14151406fetch-depth: 1
1416-persist-credentials: true
1407+token: ""
1408+persist-credentials: false
1417140914181410 - name: Check docs
14191411env:
@@ -1432,7 +1424,8 @@ jobs:
14321424uses: actions/checkout@v6
14331425with:
14341426ref: ${{ needs.preflight.outputs.checkout_revision }}
1435-persist-credentials: true
1427+token: ""
1428+persist-credentials: false
14361429submodules: false
1437143014381431 - name: Setup Python
@@ -1475,7 +1468,8 @@ jobs:
14751468uses: actions/checkout@v6
14761469with:
14771470ref: ${{ needs.preflight.outputs.checkout_revision }}
1478-persist-credentials: true
1471+token: ""
1472+persist-credentials: false
14791473submodules: false
1480147414811475 - name: Try to exclude workspace from Windows Defender (best-effort)
@@ -1568,7 +1562,8 @@ jobs:
15681562uses: actions/checkout@v6
15691563with:
15701564ref: ${{ needs.preflight.outputs.checkout_revision }}
1571-persist-credentials: true
1565+token: ""
1566+persist-credentials: false
15721567submodules: false
1573156815741569 - name: Setup Node environment
@@ -1609,7 +1604,8 @@ jobs:
16091604uses: actions/checkout@v6
16101605with:
16111606ref: ${{ needs.preflight.outputs.checkout_revision }}
1612-persist-credentials: true
1607+token: ""
1608+persist-credentials: false
16131609submodules: false
1614161016151611 - name: Install XcodeGen / SwiftLint / SwiftFormat
@@ -1710,7 +1706,6 @@ jobs:
17101706env:
17111707CHECKOUT_REPO: ${{ github.repository }}
17121708CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
1713-CHECKOUT_TOKEN: ${{ github.token }}
17141709run: |
17151710 set -euo pipefail
17161711@@ -1726,7 +1721,7 @@ jobs:
17261721 reset_checkout_dir
17271722 git init "$workdir" >/dev/null
17281723 git config --global --add safe.directory "$workdir"
1729- git -C "$workdir" remote add origin "https://x-access-token:${CHECKOUT_TOKEN}@github.com/${CHECKOUT_REPO}.git"
1724+ git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
17301725 git -C "$workdir" config gc.auto 0
1731172617321727 timeout --signal=TERM 30s git -C "$workdir" \
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。