From 3d2315f82a0c7662668a2df10223f0f15965cad3 Mon Sep 17 00:00:00 2001 From: ABC <16929811+abenseny@users.noreply.github.com> Date: Mon, 6 Jul 2026 12:51:49 +1000 Subject: [PATCH 1/5] ci: Do not persist credentials --- .github/workflows/check-pr-format.yaml | 2 ++ .github/workflows/on-pull-request.yaml | 8 ++++++++ .github/workflows/on-push.yaml | 8 ++++++++ .github/workflows/on-release.yaml | 3 +-- 4 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-pr-format.yaml b/.github/workflows/check-pr-format.yaml index 2ab13e6..92e7024 100644 --- a/.github/workflows/check-pr-format.yaml +++ b/.github/workflows/check-pr-format.yaml @@ -14,6 +14,8 @@ jobs: container: qctrl/ci-images:python-3.11-ci steps: - uses: actions/checkout@v6 + with: + persist-credentials: false - name: Check PR format shell: bash run: /scripts/check-pr-format.sh diff --git a/.github/workflows/on-pull-request.yaml b/.github/workflows/on-pull-request.yaml index 1791212..18527d4 100644 --- a/.github/workflows/on-pull-request.yaml +++ b/.github/workflows/on-pull-request.yaml @@ -17,6 +17,8 @@ jobs: container: qctrl/ci-images:python-3.11-ci steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -33,6 +35,8 @@ jobs: container: qctrl/ci-images:python-3.11-ci steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -55,6 +59,8 @@ jobs: python: ["3.10", "3.11", "3.12", "3.13"] steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -73,6 +79,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Build Sphinx Image run: | docker build -f ./docs/Dockerfile diff --git a/.github/workflows/on-push.yaml b/.github/workflows/on-push.yaml index de70df1..1363745 100644 --- a/.github/workflows/on-push.yaml +++ b/.github/workflows/on-push.yaml @@ -13,6 +13,8 @@ jobs: container: qctrl/ci-images:python-3.11-ci steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -37,6 +39,8 @@ jobs: container: qctrl/ci-images:python-3.11-ci steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -60,6 +64,8 @@ jobs: python: ["3.10", "3.11", "3.12", "3.13"] steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -80,6 +86,8 @@ jobs: container: qctrl/ci-images:python-3.11-ci steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | diff --git a/.github/workflows/on-release.yaml b/.github/workflows/on-release.yaml index fb03d0b..bf65b76 100644 --- a/.github/workflows/on-release.yaml +++ b/.github/workflows/on-release.yaml @@ -10,8 +10,7 @@ jobs: container: qctrl/ci-images:python-3.11-ci steps: - uses: actions/checkout@v4 - with: - fetch-depth: 0 + with: persist-credentials: false fetch-depth: 0 - name: Download CI tool shell: bash run: | From ac4d569f57d3f486dd90c5397f0794aee889029d Mon Sep 17 00:00:00 2001 From: ABC <16929811+abenseny@users.noreply.github.com> Date: Mon, 6 Jul 2026 12:52:45 +1000 Subject: [PATCH 2/5] fix format --- .github/workflows/on-release.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/on-release.yaml b/.github/workflows/on-release.yaml index bf65b76..d4a99ee 100644 --- a/.github/workflows/on-release.yaml +++ b/.github/workflows/on-release.yaml @@ -10,7 +10,9 @@ jobs: container: qctrl/ci-images:python-3.11-ci steps: - uses: actions/checkout@v4 - with: persist-credentials: false fetch-depth: 0 + with: + persist-credentials: false + fetch-depth: 0 - name: Download CI tool shell: bash run: | From 7504b52ce028e97198ac63dbcd5fb42df63023cb Mon Sep 17 00:00:00 2001 From: ABC <16929811+abenseny@users.noreply.github.com> Date: Tue, 28 Jul 2026 15:02:34 +1000 Subject: [PATCH 3/5] qctrl/reusable-workflows/.github/actions/github/checkout --- .github/workflows/check-pr-format.yaml | 4 +--- .github/workflows/on-pull-request.yaml | 16 ++++------------ .github/workflows/on-push.yaml | 16 ++++------------ .github/workflows/on-release.yaml | 3 +-- 4 files changed, 10 insertions(+), 29 deletions(-) diff --git a/.github/workflows/check-pr-format.yaml b/.github/workflows/check-pr-format.yaml index 92e7024..c545830 100644 --- a/.github/workflows/check-pr-format.yaml +++ b/.github/workflows/check-pr-format.yaml @@ -13,9 +13,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v6 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Check PR format shell: bash run: /scripts/check-pr-format.sh diff --git a/.github/workflows/on-pull-request.yaml b/.github/workflows/on-pull-request.yaml index 18527d4..5fc4815 100644 --- a/.github/workflows/on-pull-request.yaml +++ b/.github/workflows/on-pull-request.yaml @@ -16,9 +16,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Download CI tool shell: bash run: | @@ -34,9 +32,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Download CI tool shell: bash run: | @@ -58,9 +54,7 @@ jobs: matrix: python: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Download CI tool shell: bash run: | @@ -78,9 +72,7 @@ jobs: if: github.event.pull_request.head.repo.fork == true runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Build Sphinx Image run: | docker build -f ./docs/Dockerfile diff --git a/.github/workflows/on-push.yaml b/.github/workflows/on-push.yaml index 1363745..98070f1 100644 --- a/.github/workflows/on-push.yaml +++ b/.github/workflows/on-push.yaml @@ -12,9 +12,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Download CI tool shell: bash run: | @@ -38,9 +36,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Download CI tool shell: bash run: | @@ -63,9 +59,7 @@ jobs: matrix: python: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Download CI tool shell: bash run: | @@ -85,9 +79,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 - name: Download CI tool shell: bash run: | diff --git a/.github/workflows/on-release.yaml b/.github/workflows/on-release.yaml index d4a99ee..96880c1 100644 --- a/.github/workflows/on-release.yaml +++ b/.github/workflows/on-release.yaml @@ -9,9 +9,8 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 + - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 with: - persist-credentials: false fetch-depth: 0 - name: Download CI tool shell: bash From 51b07a2ddb69ec1ddb27ac74ca86cdf2355e84d1 Mon Sep 17 00:00:00 2001 From: ABC <16929811+abenseny@users.noreply.github.com> Date: Tue, 28 Jul 2026 15:15:26 +1000 Subject: [PATCH 4/5] Revert "qctrl/reusable-workflows/.github/actions/github/checkout" This reverts commit 7504b52ce028e97198ac63dbcd5fb42df63023cb. --- .github/workflows/check-pr-format.yaml | 4 +++- .github/workflows/on-pull-request.yaml | 16 ++++++++++++---- .github/workflows/on-push.yaml | 16 ++++++++++++---- .github/workflows/on-release.yaml | 3 ++- 4 files changed, 29 insertions(+), 10 deletions(-) diff --git a/.github/workflows/check-pr-format.yaml b/.github/workflows/check-pr-format.yaml index c545830..92e7024 100644 --- a/.github/workflows/check-pr-format.yaml +++ b/.github/workflows/check-pr-format.yaml @@ -13,7 +13,9 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v6 + with: + persist-credentials: false - name: Check PR format shell: bash run: /scripts/check-pr-format.sh diff --git a/.github/workflows/on-pull-request.yaml b/.github/workflows/on-pull-request.yaml index 5fc4815..18527d4 100644 --- a/.github/workflows/on-pull-request.yaml +++ b/.github/workflows/on-pull-request.yaml @@ -16,7 +16,9 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -32,7 +34,9 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -54,7 +58,9 @@ jobs: matrix: python: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -72,7 +78,9 @@ jobs: if: github.event.pull_request.head.repo.fork == true runs-on: ubuntu-latest steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Build Sphinx Image run: | docker build -f ./docs/Dockerfile diff --git a/.github/workflows/on-push.yaml b/.github/workflows/on-push.yaml index 98070f1..1363745 100644 --- a/.github/workflows/on-push.yaml +++ b/.github/workflows/on-push.yaml @@ -12,7 +12,9 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -36,7 +38,9 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -59,7 +63,9 @@ jobs: matrix: python: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | @@ -79,7 +85,9 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Download CI tool shell: bash run: | diff --git a/.github/workflows/on-release.yaml b/.github/workflows/on-release.yaml index 96880c1..d4a99ee 100644 --- a/.github/workflows/on-release.yaml +++ b/.github/workflows/on-release.yaml @@ -9,8 +9,9 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: qctrl/reusable-workflows/.github/actions/github/checkout@actions/github/checkout/v1 + - uses: actions/checkout@v4 with: + persist-credentials: false fetch-depth: 0 - name: Download CI tool shell: bash From 5efe1bd1bc7026f511762912e65d1ae89c68355f Mon Sep 17 00:00:00 2001 From: ABC <16929811+abenseny@users.noreply.github.com> Date: Tue, 28 Jul 2026 15:24:46 +1000 Subject: [PATCH 5/5] bump checkout to v7 --- .github/workflows/check-pr-format.yaml | 2 +- .github/workflows/on-pull-request.yaml | 8 ++++---- .github/workflows/on-push.yaml | 8 ++++---- .github/workflows/on-release.yaml | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/check-pr-format.yaml b/.github/workflows/check-pr-format.yaml index 92e7024..a0679c8 100644 --- a/.github/workflows/check-pr-format.yaml +++ b/.github/workflows/check-pr-format.yaml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Check PR format diff --git a/.github/workflows/on-pull-request.yaml b/.github/workflows/on-pull-request.yaml index 18527d4..55e1392 100644 --- a/.github/workflows/on-pull-request.yaml +++ b/.github/workflows/on-pull-request.yaml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Download CI tool @@ -34,7 +34,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Download CI tool @@ -58,7 +58,7 @@ jobs: matrix: python: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Download CI tool @@ -78,7 +78,7 @@ jobs: if: github.event.pull_request.head.repo.fork == true runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Build Sphinx Image diff --git a/.github/workflows/on-push.yaml b/.github/workflows/on-push.yaml index 3bdd2ed..d23316c 100644 --- a/.github/workflows/on-push.yaml +++ b/.github/workflows/on-push.yaml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Download CI tool @@ -38,7 +38,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Download CI tool @@ -63,7 +63,7 @@ jobs: matrix: python: ["3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Download CI tool @@ -85,7 +85,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Download CI tool diff --git a/.github/workflows/on-release.yaml b/.github/workflows/on-release.yaml index d4a99ee..55b7e4f 100644 --- a/.github/workflows/on-release.yaml +++ b/.github/workflows/on-release.yaml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest container: qctrl/ci-images:python-3.11-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false fetch-depth: 0