Merge pull request #354 from github/workflow-updates

Workflow Updates

Author: GrantBirki

.github/workflows/actions-config-validation.yml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: actions-config-validation
         uses: GrantBirki/json-yaml-validate@e42e6ece9b97f2b220274c909a9a98e380c2c9fd # [email protected]

.github/workflows/codeql-analysis.yml

@@ -27,6 +27,8 @@ jobs:
     steps:
     - name: checkout
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/lint.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: setup node
         uses: actions/setup-node@v4

.github/workflows/package-check.yml

@@ -16,6 +16,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: setup node
         uses: actions/setup-node@v4

.github/workflows/test.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: setup node
         uses: actions/setup-node@v4

.github/workflows/update-latest-release-tag.yml

@@ -23,14 +23,20 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: git config
         run: |
           git config user.name github-actions
           git config user.email [email protected]
 
       - name: tag new target
-        run: git tag -f ${{ github.event.inputs.major_version_tag }} ${{ github.event.inputs.source_tag }}
+        env:
+          SOURCE_TAG: ${{ github.event.inputs.source_tag }}
+          MAJOR_VERSION_TAG: ${{ github.event.inputs.major_version_tag }}
+        run: git tag -f ${MAJOR_VERSION_TAG} ${SOURCE_TAG}
 
       - name: push new tag
-        run: git push origin ${{ github.event.inputs.major_version_tag }} --force
+        env:
+          MAJOR_VERSION_TAG: ${{ github.event.inputs.major_version_tag }}
+        run: git push origin ${MAJOR_VERSION_TAG} --force