fix(ci): stop persisting a write-scoped git credential through npm ci

[wyre-agent-fleet]

Stops persisting a write-scoped git credential through npm ci (CWE-250).

The release job declares contents: write, which overrides this repo's
read-only default workflow permission — so actions/checkout's default
persisted credential was write-scoped and stayed live in .git/config
through dependency install, build and test, readable by any compromised
dependency lifecycle script during that window. persist-credentials: false
is semantic-release's own documented GitHub Actions recipe: it authenticates
its own pushes from GITHUB_TOKEN directly and never needed the persisted
credential.

Part of a pattern-set fix across WYRE-AI/node-*. Originally found and
fixed on 4 repos (node-spanning#46, node-domotz#48,
node-kaseya-quote-manager#16, node-alternative-payments#20), then a
propagation scope-check found the same pattern on 18 more repos. Full set
(18, this repo included) so reviewers can see membership:

node-axcient, node-blumira, node-clio, node-connectwise-cpq, node-datto-bcdr, node-datto-saas-protection, node-huntress, node-iqms, node-kaseya-bms, node-kaseya-vsa, node-mailprotector, node-mimecast, node-ncentral, node-proofpoint-essentials, node-rootly, node-scalepad, node-threatlocker, node-unitrends

Generated by warden's Gate-3 CWE-250 review, per boss's set-completeness ruling.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Security

  • Improved handling of authentication credentials during automated release activities, reducing the risk of credentials persisting beyond their intended use.

• Documentation

  • Added changelog coverage for the updated release workflow and its credential-handling behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: dd712fe3-7fa9-442a-8d5b-60894c115167

📥 Commits

Reviewing files that changed from the base of the PR and between cc8b09e and f8896bf.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• CHANGELOG.md

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow disables persisted checkout credentials. The changelog documents this behavior and semantic-release authentication through GITHUB_TOKEN.

Changes

Release credential handling

Layer / File(s)	Summary
Checkout credential control .github/workflows/release.yml, CHANGELOG.md	The release checkout sets persist-credentials: false. The changelog records that semantic-release uses GITHUB_TOKEN for pushes.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: asachs01

Merge Risk: ⚪ Minimal · up to f8896

The change reduces credential exposure while preserving authenticated release operations.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing npm ci from accessing a persisted write-scoped Git credential in the release workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Changelog Entry	✅ Passed	PASS. The PR changes only the release CI workflow and CHANGELOG.md. The workflow adds persist-credentials: false to actions/checkout; this is a CI security change. The PR also adds a ### Changed…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cwe-250-persist-credentials

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/cwe-250-persist-credentials

---

_{Comment @coderabbitai help to get the list of available commands.}

[wyre-agent-fleet]

Peer review (comment-only, per the shared-identity self-approval gate).

Verdict: approve, no blockers.

Verified independently against the actual diff content (not just warden's filing summary), as part of the 18-PR CWE-250 follow-up set-review:

• release.yml: adds persist-credentials: false to the release job's actions/checkout step, with the same explanatory comment across all 18 PRs (CWE-250: the release job's contents: write permission makes checkout's default persisted credential write-scoped and live in .git/config through npm ci; persist-credentials: false is semantic-release's own documented recipe since it authenticates pushes via GITHUB_TOKEN directly). The core fix content is byte-identical across the batch -- raw diff size varies only where a repo's pre-existing checkout step used a different YAML style (inline vs multi-line map).
• CHANGELOG.md: entry added under this repo's existing Unreleased section, correct per this repo's own convention.
• No unrelated files touched -- scope is clean.

Full batch (all independently verified): node-axcient#2, node-blumira#41, node-clio#2, node-connectwise-cpq#2, node-datto-bcdr#55, node-datto-saas-protection#55, node-huntress#43, node-iqms#39, node-kaseya-bms#48, node-kaseya-vsa#50, node-mailprotector#2, node-mimecast#44, node-ncentral#4, node-proofpoint-essentials#1, node-rootly#27, node-scalepad#2, node-threatlocker#31, node-unitrends#51

[asachs01]

Review Summary — Verdict: Approve

Correctness: Same pattern-set fix as the sibling node-* repos — adds persist-credentials: false to the pinned actions/checkout@3d3c42e... step in the release job. Correctly stops the write-scoped git credential (elevated by the job's contents: write permission) from persisting in .git/config through npm ci, build, and test. semantic-release authenticates independently via GITHUB_TOKEN, so no functional loss.

Security: This is the fix itself; reduces credential exposure window with no downside. No secrets introduced.

Code quality: Clean, minimal diff with a clear explanatory comment.

Tests: N/A for a CI workflow permission tweak; no regression risk to the checkout step's other behavior (fetch-depth: 0 retained).

Docs: CHANGELOG.md updated under [Unreleased] / Changed with an accurate description consistent with the PR body.

No issues found. LGTM.

[asachs01]

Code Review Summary — Claude Code

Verdict: Approve

Critical

None

Warnings

None

Suggestions

None

Looks Good

• Correct, minimal fix: persist-credentials: false added to the SHA-pinned actions/checkout step used by the release job.
• Root cause accurately diagnosed — contents: write on the release job upgrades the default checkout credential to write-scoped, and it otherwise persists in .git/config through npm ci, build, and test (CWE-250 exposure window for a compromised dependency lifecycle script).
• Safe to disable since semantic-release authenticates its own push via GITHUB_TOKEN, not the persisted git credential.
• Good practice already in place here: actions/checkout is pinned to a commit SHA rather than a mutable tag.
• Changelog entry accurately documents the change and rationale.

[asachs01]

Reviewed by Claude Code. Adds persist-credentials: false to actions/checkout in the release workflow so the write-scoped git credential (from contents: write) isn't live in .git/config during npm ci; semantic-release pushes via GITHUB_TOKEN directly so no auth is lost. Correct, minimal, well-documented fix.

[asachs01]

Code Review Summary (Reviewed by Hermes Agent)

Critical: None.

Warnings: None.

Suggestions:

• Correct, minimal fix: adds persist-credentials: false to the release job's actions/checkout step. This job declares contents: write (overriding the repo's read-only default), so without this flag the write-scoped token would have stayed live in .git/config through npm ci/build — readable by any compromised dependency lifecycle script (CWE-250).
• Confirmed semantic-release still authenticates its own push/API calls via GITHUB_TOKEN passed directly in the Release step's env, so removing the persisted credential does not break the release flow.
• No new leak introduced: nothing in the diff writes the token to a log, file, or artifact.

Looks Good: Sound, well-scoped credential-hardening fix.

[asachs01]

Reviewed against the verified fleet-wide fix pattern: this diff adds persist-credentials: false to the actions/checkout step in .github/workflows/release.yml (with matching CHANGELOG entry), preventing the write-scoped git credential from persisting through npm ci in the release job (CWE-250). semantic-release authenticates its own pushes via GITHUB_TOKEN directly, so this credential was unnecessary and its removal introduces no functional regression. Matches the pattern confirmed in WYRE-AI/node-unitrends#51. Approved.

Reviewed by Hermes Agent

[asachs01]

Review — headRefOid f8896bfed6d2062fce6c67f9c14dc19ac6179a53

Minimal, well-scoped CI fix. Adds persist-credentials: false to the release job's actions/checkout step (which currently runs with an inherited contents: write-scoped credential live in .git/config through npm ci/build/test), plus a matching CHANGELOG entry. This matches the semantic-release documented pattern (auth via GITHUB_TOKEN directly, no persisted credential needed) and closes a real CWE-250 exposure window where a compromised dependency lifecycle script could read a write-scoped token off disk.

Critical: None.

Warnings: None. The change is additive/config-only and doesn't touch runtime code paths.

Suggestions:

• Confirm semantic-release's push step still authenticates correctly post-change (CI run on this PR should confirm; also confirmed already by CodeRabbit's approval + prior propagation to the other 17 sibling repos).
• No functional/unit tests apply here since this is CI-workflow-only; that's appropriate for this change.

Looks Good:

• Correct root-cause diagnosis (implicit contents: write overriding default read-only permissions).
• Rationale is clearly documented inline and in the changelog.
• Consistent with the same fix already applied/reviewed across 17 other WYRE-AI node-* repos.

Verdict: Comment only — looks correct and low-risk; deferring to CODEOWNERS/CI to confirm the release job still runs green before merge.

[asachs01]

Code Review Summary

Verdict: Approve

Correctness

Adds persist-credentials: false to the actions/checkout step in the release workflow. This is correct: the release job declares contents: write, which overrides the repo's read-only default GITHUB_TOKEN permission, so the checkout step's persisted credential was write-scoped and stayed live in .git/config for the whole job (dependency install, build, test) — readable by any compromised dependency lifecycle script (CWE-250). persist-credentials: false is semantic-release's own documented recipe; semantic-release authenticates its own push via GITHUB_TOKEN directly, so no functional regression is expected.

Security

This is the security fix — closes a credential-exposure window. No new secrets or credentials introduced. Scope is minimal (workflow file + changelog only).

Code Quality

Change is small, well-commented inline explaining the why, and consistent with the sibling fixes already merged in node-spanning#46 / node-domotz#48 / node-kaseya-quote-manager#16 / node-alternative-payments#20.

Tests

No test coverage for CI workflow YAML is expected/typical; nothing to add here. Recommend confirming the next automated release run on main still succeeds (semantic-release push, tag, npm publish) since that's the one behavior this touches at runtime.

Documentation

CHANGELOG.md entry accurately describes the change and rationale. Good.

Looks Good

• Root cause explanation is precise and matches GitHub Actions' documented permission-override behavior for job-level contents: write.
• No unrelated changes bundled in.

Reviewed SHA: f8896bf

[asachs01]

Claude Code Review

Verdict: Approve

Looks Good

• Correct, minimal fix: adds persist-credentials: false to the actions/checkout step in the release job. This is semantic-release's own documented recipe and directly addresses the CWE-250 concern (write-scoped GITHUB_TOKEN credential otherwise persisted in .git/config through npm ci/build/test).
• Change is scoped correctly — only the checkout step in the job with contents: write, no unrelated modifications.
• CHANGELOG entry is clear and accurately explains the rationale.

Suggestions

• None — this is a well-justified, single-purpose security hardening change consistent with the pattern already applied across sibling node-* repos.

No tests needed for a workflow-permission-only change; nothing else in the diff to flag.

[asachs01]

Claude Code Review

Verdict: Approve

Small, well-scoped CI fix.

Looks Good

• persist-credentials: false added to the actions/checkout step in the release job, matching semantic-release's own documented recipe (it authenticates pushes via GITHUB_TOKEN directly).
• Correctly diagnosed: the release job elevates to contents: write, so the default persisted checkout credential is write-scoped and otherwise stays live in .git/config through npm ci/build/test — a real CWE-250 exposure window for any compromised dependency lifecycle script.
• CHANGELOG entry added, consistent with repo convention.
• Change is minimal and low-risk — no functional/build behavior change, pure hardening.

Suggestions

• None — this is a straightforward, correct fix. Worth confirming CI still authenticates/pushes fine post-merge (semantic-release relies on GITHUB_TOKEN, not the persisted git credential, so this should be a non-issue).

[asachs01]

Hermes Agent Review

Verdict: Approve

Correct, minimal fix for CWE-250 (write-scoped git credential left live in .git/config through npm ci). persist-credentials: false is the documented semantic-release recipe since it authenticates its own pushes via GITHUB_TOKEN — no functional regression, changelog entry included, scoped to the affected job only.

Looks Good

• Fix is correctly scoped (only the release job, which is the one declaring contents: write)
• Rationale comment inline explains the CWE and why persist-credentials: false is safe here
• Changelog entry present

No blocking issues.

---

Reviewed by Hermes Agent