From 41d0e05c63763e2f993a159f5576ac4067dccc35 Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Fri, 24 Jul 2026 22:19:11 -0700
Subject: [PATCH] Fix broken gem releases: restore persisted checkout
 credentials in cd.yml

The deploy job's checkout step set persist-credentials: false, but
discourse/publish-rubygems-action's entrypoint.sh runs `rake release`,
which does a raw `git push` and never re-authenticates using
GITHUB_TOKEN itself - it relies entirely on the git credential that
checkout leaves behind. Disabling persistence broke every deploy with:

  fatal: could not read Username for 'https://github.com': No such
  device or address

Confirmed in production: rubyatscale/danger-migrations (which calls
this same reusable cd.yml) has failed 9 of its last 10 CD runs since
this line was added, all with that exact error.

Also fixes two stale/incorrect version comments caught by zizmor's
ref-version-mismatch audit (only visible with --gh-token, not in the
default offline mode): the checkout SHA is actually tagged v7.0.0, not
v6, and the slack-github-action SHA is v3.0.3, not just v3.

Verified with `zizmor .github/workflows/cd.yml`, both offline and
--gh-token: 0 findings.
---
 .github/workflows/cd.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 2092eea..4102176 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -7,9 +7,11 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
-        with:
-          persist-credentials: false
+      # persisted credentials are required here - discourse/publish-rubygems-action's entrypoint.sh runs
+      # `rake release`, which does a raw `git push` and never re-authenticates from GITHUB_TOKEN itself; it
+      # relies entirely on the credential this checkout step leaves behind. Disabling persistence breaks every
+      # deploy with "fatal: could not read Username for 'https://github.com'".
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] persisted credentials required for the git push in "Tag and Push Gem" below
       - name: Tag and Push Gem
         id: tag-and-push-gem
         uses: discourse/publish-rubygems-action@4bd305c65315cb691bad1e8de97a87aaf29a0a85 # v3
@@ -29,7 +31,7 @@ jobs:
     needs: [deploy]
     if: ${{ failure() && github.ref == 'refs/heads/main' }}
     steps:
-      - uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3
+      - uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
           webhook-type: incoming-webhook