Fix broken gem releases: restore persisted checkout credentials in cd.yml#27
Merged
Conversation
….yml The deploy job's checkout step set persist-credentials: false, but discourse/publish-rubygems-action's entrypoint.sh runs `rake release`, which does a raw `git push` and never re-authenticates using GITHUB_TOKEN itself - it relies entirely on the git credential that checkout leaves behind. Disabling persistence broke every deploy with: fatal: could not read Username for 'https://github.com': No such device or address Confirmed in production: rubyatscale/danger-migrations (which calls this same reusable cd.yml) has failed 9 of its last 10 CD runs since this line was added, all with that exact error. Also fixes two stale/incorrect version comments caught by zizmor's ref-version-mismatch audit (only visible with --gh-token, not in the default offline mode): the checkout SHA is actually tagged v7.0.0, not v6, and the slack-github-action SHA is v3.0.3, not just v3. Verified with `zizmor .github/workflows/cd.yml`, both offline and --gh-token: 0 findings.
1 task
dduugg
added a commit
that referenced
this pull request
Jul 25, 2026
Fixes the 9 open alerts at https://github.com/rubyatscale/shared-config/security/code-scanning: - zizmor/ref-version-mismatch (8 alerts): stale version comments on already-pinned SHAs across ci.yml, stale.yml, and zizmor.yml. Floating major tags (v6, v1, v3, v10) move forward as new releases ship, so a comment written when a SHA was "the current v6" goes stale once v6 moves on. Same class of issue already fixed in cd.yml (#27). Updated each comment to the precise version currently tagged at that exact SHA (v7.0.0, v1.314.0, v3.0.3, v10.3.0 respectively) - the pinned SHAs themselves are unchanged. - zizmor/artipacked (1 alert): codeql.yml's checkout step didn't set persist-credentials: false. Unlike cd.yml's deploy job, this one only reads the repo for analysis and never pushes, so disabling persistence is correct here (no exception needed). Verified with `zizmor .github/workflows/`, both offline and --gh-token: 0 findings across every workflow in the repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every gem release via this reusable
cd.ymlhas been silently broken sincepersist-credentials: falsewas added to thedeployjob's checkout step.discourse/publish-rubygems-action'sentrypoint.shrunsrake release, which does a rawgit push— but the script never authenticates withGITHUB_TOKENitself (confirmed by reading the action's source: it only ever usesGITHUB_TOKEN... it doesn't, actually — it's passed inenv:but the entrypoint never references it). It relies entirely on the git credential thatactions/checkoutleaves behind. Disabling persistence means there's nothing to push with.This isn't theoretical — confirmed in production:
rubyatscale/danger-migrations(which calls this same reusable workflow) has failed 9 of its last 10 CD runs since this line was added (2026-04-14 per this repo's history), with no successful release since 2026-03-05. Every other repo callingshared-config/cd.yml@main— includingrubyatscale/visualize_packs— is equally affected and just hasn't attempted a real release recently enough to notice.Changes
persist-credentials: falsefrom thedeployjob's checkout step (reverts to the defaulttrue, which is required here), with a# zizmor: ignore[artipacked]suppression and comment explaining why — this step deliberately needs to leave credentials behind, unlike a typical read-only checkout.zizmor'sref-version-mismatchaudit (only visible in online mode via--gh-token, not the default offline mode): the checkout SHA is actually taggedv7.0.0today (notv6— floating major tags move), and the slack-github-action SHA isv3.0.3(not justv3).Test plan
zizmor .github/workflows/cd.yml— 0 findings, both offline and with--gh-tokendanger-migrationsorvisualize_packs) actually succeeds in pushing its tag