# actions/checkout

By Saurabh Kumar · TIL note, Dec 10, 2024 · Tags: security, devops

Source: https://saurabh-kumar.com/til/1733832000/

[`actions/checkout`](https://github.com/actions/checkout) saves the workflow token (`GITHUB_TOKEN` or a custom one) in the checked-out repo's `.git/config` by default. Workflows that upload the repo as an artifact leak it, and [Unit 42 found many projects doing this](https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/). GitHub calls it intended behaviour. Turn it off, and scan workflows with [zizmor](https://github.com/woodruffw/zizmor), which [would have caught the Ultralytics injection](https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection).
```yml
- uses: actions/checkout@v4
  with:
    persist-credentials: false
```