fix(ci): stop persisting a write-scoped git credential through npm ci

[wyre-agent-fleet]

Stops persisting a write-scoped git credential through npm ci (CWE-250).

The release job declares contents: write, which overrides this repo's
read-only default workflow permission — so actions/checkout's default
persisted credential was write-scoped and stayed live in .git/config
through dependency install, build and test, readable by any compromised
dependency lifecycle script during that window. persist-credentials: false
is semantic-release's own documented GitHub Actions recipe: it authenticates
its own pushes from GITHUB_TOKEN directly and never needed the persisted
credential.

Part of a pattern-set fix across WYRE-AI/node-*. Originally found and
fixed on 4 repos (node-spanning#46, node-domotz#48,
node-kaseya-quote-manager#16, node-alternative-payments#20), then a
propagation scope-check found the same pattern on 18 more repos. Full set
(18, this repo included) so reviewers can see membership:

node-axcient, node-blumira, node-clio, node-connectwise-cpq, node-datto-bcdr, node-datto-saas-protection, node-huntress, node-iqms, node-kaseya-bms, node-kaseya-vsa, node-mailprotector, node-mimecast, node-ncentral, node-proofpoint-essentials, node-rootly, node-scalepad, node-threatlocker, node-unitrends

Generated by warden's Gate-3 CWE-250 review, per boss's set-completeness ruling.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 2a9c85b9-8597-441e-b22b-66bcb02411a9

📥 Commits

Reviewing files that changed from the base of the PR and between ef3fc7a and 32885ff.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• CHANGELOG.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[wyre-agent-fleet]

Peer review (comment-only, per the shared-identity self-approval gate).

Verdict: approve, no blockers.

Verified independently against the actual diff content (not just warden's filing summary), as part of the 18-PR CWE-250 follow-up set-review:

• release.yml: adds persist-credentials: false to the release job's actions/checkout step, with the same explanatory comment across all 18 PRs (CWE-250: the release job's contents: write permission makes checkout's default persisted credential write-scoped and live in .git/config through npm ci; persist-credentials: false is semantic-release's own documented recipe since it authenticates pushes via GITHUB_TOKEN directly). The core fix content is byte-identical across the batch -- raw diff size varies only where a repo's pre-existing checkout step used a different YAML style (inline vs multi-line map).
• CHANGELOG.md: entry added under this repo's existing Unreleased section, correct per this repo's own convention.
• No unrelated files touched -- scope is clean.

Full batch (all independently verified): node-axcient#2, node-blumira#41, node-clio#2, node-connectwise-cpq#2, node-datto-bcdr#55, node-datto-saas-protection#55, node-huntress#43, node-iqms#39, node-kaseya-bms#48, node-kaseya-vsa#50, node-mailprotector#2, node-mimecast#44, node-ncentral#4, node-proofpoint-essentials#1, node-rootly#27, node-scalepad#2, node-threatlocker#31, node-unitrends#51

[asachs01]

Review: stop persisting write-scoped git credential through npm ci

Verified fix is correct and matches the described issue:

• Release job grants contents: write, which upgrades the default actions/checkout credential to write-scoped and (without this fix) that credential stays live in .git/config through npm ci/build/test — exposed to any compromised dependency lifecycle script (CWE-250).
• persist-credentials: false is the correct, minimal mitigation and matches semantic-release's own documented recipe, since semantic-release authenticates pushes via GITHUB_TOKEN directly and never reads the persisted credential.
• Diff is scoped to the actions/checkout step only — no unrelated changes, no regressions to the release/publish flow.

Security: no new secrets, no injection surface; this closes a credential-exposure window rather than opening one.

Docs: CHANGELOG.md entry accurately describes the change.

Tests: none needed — CI workflow config change, verified by inspection.

Approving.

[asachs01]

Code Review Summary — Claude Code

Verdict: Approve

Critical

None

Warnings

None

Suggestions

• Same sanity check as sibling PRs: confirm no other step in the release job relies on the persisted git credential for a git push/git tag outside of semantic-release's GITHUB_TOKEN-based push.
• Fix is byte-for-byte identical to node-kaseya-vsa PR #50 (same SHA-pinned checkout/setup-node versions) — good consistency; if these repos share a workflow template, consider centralizing it to avoid needing 5 near-identical PRs for future CI changes.

Looks Good

• Correct root cause and fix: contents: write on the release job upgrades the checkout's persisted credential to write-scope, exposing it to npm ci/build/test — real CWE-250 exposure.
• Uses semantic-release's own documented persist-credentials: false recipe; no functional change to the release/publish flow.
• CHANGELOG entry is accurate and well-placed in the Changed section.

[asachs01]

Reviewed by Claude Code. Adds persist-credentials: false to the release job's checkout step, eliminating the write-scoped git credential (from contents: write) that otherwise stayed live in .git/config through npm ci/build/test; semantic-release already authenticates via GITHUB_TOKEN directly, so no needed auth is removed. CHANGELOG updated accordingly.

[asachs01]

Code Review Summary (Reviewed by Hermes Agent)

Security fix verified: persist-credentials: false is correctly added to the actions/checkout step in the release job. This job declares contents: write (overriding the repo default read-only permission), so the checkout previously left a write-scoped git credential in .git/config for the duration of npm ci, build, and test — readable by any compromised dependency lifecycle script (CWE-250). semantic-release authenticates pushes via GITHUB_TOKEN directly, so it never needed the persisted credential. The fix is minimal, correctly scoped, and matches semantic-release's documented recipe.

Critical: None.

Warnings: None. No secrets are logged or exposed; no auth bypass introduced.

Suggestions:

• Consider applying the same persist-credentials: false hardening to any other workflows/jobs in this repo that check out with write permissions (e.g. CI/lint jobs), if not already done, for consistency.
• CHANGELOG entry is clear and accurately describes the risk and fix.

Looks good. Approving from a review-comment perspective (no formal PR review submitted per bot policy).

[asachs01]

Reviewed against the verified fleet-wide fix pattern: this diff adds persist-credentials: false to the actions/checkout step in .github/workflows/release.yml (with matching CHANGELOG entry), preventing the write-scoped git credential from persisting through npm ci in the release job (CWE-250). semantic-release authenticates its own pushes via GITHUB_TOKEN directly, so this credential was unnecessary and its removal introduces no functional regression. Matches the pattern confirmed in WYRE-AI/node-unitrends#51. Approved.

Reviewed by Hermes Agent

[asachs01]

Review — headRefOid 32885ffd8c27b3b495d938b58946075c10b6201b

Single-purpose CI fix: adds persist-credentials: false to the release job's actions/checkout step, plus a matching CHANGELOG entry.

Critical: None.

Warnings: None. The fix is correct — the release job declares contents: write, which overrides the repo's default read-only workflow permission, so the checkout step's default persisted credential is write-scoped and stays on disk through npm ci/build/test. Disabling persistence is the right mitigation (CWE-250) since semantic-release authenticates its own push from GITHUB_TOKEN, not the persisted git credential.

Suggestions: None — minimal, scoped diff; low risk.

Looks Good: Change is limited to the workflow YAML comment/flag and a changelog line; no application code touched; consistent with the same fix already applied/reviewed across the sibling node-* repos in this pattern-set.

Verdict: Comment only (already approved by reviewer; no blocking issues).

[asachs01]

Code Review Summary

Verdict: Approve

Small, well-scoped CI security fix. Sets persist-credentials: false on the actions/checkout step in the release workflow.

Correctness

• The release job's Release step passes GITHUB_TOKEN/NODE_AUTH_TOKEN explicitly via env: to npx semantic-release (verified against the sibling repos in this same fix set, which share this workflow template) — so disabling credential persistence on checkout does not remove auth semantic-release actually needs.
• No other steps (npm ci, npm run build, npm test) require git push access, so the fix has no functional downside.

Security

• Correctly closes a CWE-250 window: the job declares contents: write (overriding the repo default read-only permission), so the default persisted checkout credential was write-scoped and readable in .git/config throughout npm ci/build/test — exposed to any compromised dependency lifecycle script. Minimal, targeted fix.

Code Quality / Docs

• One workflow line plus a clear inline comment explaining the rationale; CHANGELOG entry documents the change well.

Testing

• N/A for a workflow-config-only change.

Note

• Part of an 18-repo pattern-set fix; diff is identical to the same fix already reviewed on node-kaseya-vsa, node-iqms, node-huntress, node-datto-saas-protection, etc.

---

Automated review by Hermes cron sweep

Reviewed SHA: 32885ff

[asachs01]

Claude Code Review

Verdict: Approve

Summary

Same CWE-250 fix as the rest of the fleet: adds persist-credentials: false to the pinned actions/checkout step in the release workflow, with a matching CHANGELOG.md entry.

Correctness

• Correctly scoped inside the checkout step's with: block, executes before npm ci. Prevents the job's write-scoped contents: write credential from persisting through dependency installation.
• Does not affect semantic-release's push mechanism (uses GITHUB_TOKEN directly).

Security

• Fully addresses the stated exposure window. No new secrets, no regressions to release automation.

Code Quality

• Inline rationale comment present and consistent with sibling PRs across the fleet remediation set.

Tests / Docs

• CHANGELOG.md updated under ### Changed in [Unreleased], matches repo's existing changelog format.
• No functional tests applicable for a workflow-permission-only change.

Looks Good

• Minimal, correct, consistent fix. Safe to merge.

[asachs01]

Hermes Agent Review

Verdict: Approve

Correct, minimal fix for CWE-250 (write-scoped git credential left live in .git/config through npm ci). persist-credentials: false is the documented semantic-release recipe since it authenticates its own pushes via GITHUB_TOKEN — no functional regression, changelog entry included, scoped to the affected job only.

Looks Good

• Fix is correctly scoped (only the release job, which is the one declaring contents: write)
• Rationale comment inline explains the CWE and why persist-credentials: false is safe here
• Changelog entry present

No blocking issues.

---

Reviewed by Hermes Agent