ACTIONS CHECKOUT CREDENTIALS CHECK · RUNS IN YOUR BROWSER

Which of your Actions jobs leave the token in .git/config?

actions/checkout writes the job's GITHUB_TOKEN into .git/config unless the step sets persist-credentials: false. If the same job then uploads the workspace as an artifact, the token can travel with it (the "artipacked" pattern). Paste your workflow YAML below to list every checkout step that leaves the token on disk, the risky ones first, each with the one-line fix.

Nothing is uploaded. The YAML you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own.

1. Paste one or more workflow files

Copy the contents of each file under .github/workflows/ you want checked. Add more blocks for more files.

Paste at least one workflow file above and click Check.

Prefer a CLI, or want this in your own CI?

Same logic, zero dependencies, one file:

python3 check.py                  # scan .github/workflows under the current directory
python3 check.py /path/to/repo    # scan a specific checkout
python3 check.py --format json    # machine-readable
python3 check.py --fail-on-risk   # exit 2 if any finding exists

Get check.py from the repo — stdlib only, no network calls.

Common questions

What does persist-credentials: false do in actions/checkout?

By default actions/checkout writes the job's GITHUB_TOKEN into .git/config so later git commands can authenticate. Setting persist-credentials: false stops that, so the token is not left on disk for the rest of the job.

What is the artipacked pattern?

A job checks out the repository with the default settings and then uploads the workspace (including the .git directory) with actions/upload-artifact. The token in .git/config travels inside the artifact, which anyone who can read the run may download. This tool lists those jobs first.

What if my job needs to git push?

Then pass the token to that one step only, for example through an environment variable, instead of leaving it in .git/config for every later step. If you deliberately set persist-credentials: true, this tool still flags the job so you can confirm it is intended.

Does this tool fetch anything from GitHub for me?

No. It makes no network calls at all. Paste your workflow YAML and the scan runs entirely in this page.

Does a clean scan mean my workflows are safe?

No. This checks one specific pattern with a line-oriented scan, not a YAML parser. It is not a security audit and it does not look at any other workflow risk.