SEC006 — missing-persist-credentials-false

Severity: warning · Category: Security · Autofix: yes

What it checks

Flags an actions/checkout step that doesn't set persist-credentials at all — neither true nor false. An explicit persist-credentials: true is not flagged, since that's a deliberate, documented choice (e.g. a job that pushes a commit), not the silent default this rule targets.

Why it matters

By default, actions/checkout writes a git credential to disk so later steps in the same job can push. Most jobs never push anything — for those, that credential sitting on disk is a way for it to leak that serves no purpose (for example, via an artifact upload that accidentally includes the whole workspace).

Examples

Flagged — no git operations happen after this, but the credential is written to disk anyway, by default:

steps:
  - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.2.2
  - run: npm test

Fixed:

steps:
  - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.2.2
    with:
      persist-credentials: false
  - run: npm test

If the job genuinely needs to push (a docs deploy, a generated-file commit), set it explicitly to true instead — that documents the intent and is not flagged.

Suppressing

  - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # vlotpipe: ignore[SEC006]

Prefer setting persist-credentials: true explicitly instead of suppressing — it fixes the underlying "why does this exist" question rather than just silencing the finding.

Autofix

vlotpipe scan --fix (or check --fix) adds persist-credentials: false, creating the step's with: block if it doesn't have one yet. If an existing with: block is written in flow style (with: { ... }) the fix is skipped rather than risk mangling it — that occurrence stays unfixed and reported normally.