fix(ci): stop persisting a write-scoped git credential through npm ci

[wyre-agent-fleet]

Stops persisting a write-scoped git credential through npm ci (CWE-250).

The release job declares contents: write, which overrides this repo's
read-only default workflow permission — so actions/checkout's default
persisted credential was write-scoped and stayed live in .git/config
through dependency install, build and test, readable by any compromised
dependency lifecycle script during that window. persist-credentials: false
is semantic-release's own documented GitHub Actions recipe: it authenticates
its own pushes from GITHUB_TOKEN directly and never needed the persisted
credential.

Part of a pattern-set fix across WYRE-AI/node-*. Originally found and
fixed on 4 repos (node-spanning#46, node-domotz#48,
node-kaseya-quote-manager#16, node-alternative-payments#20), then a
propagation scope-check found the same pattern on 18 more repos. Full set
(18, this repo included) so reviewers can see membership:

node-axcient, node-blumira, node-clio, node-connectwise-cpq, node-datto-bcdr, node-datto-saas-protection, node-huntress, node-iqms, node-kaseya-bms, node-kaseya-vsa, node-mailprotector, node-mimecast, node-ncentral, node-proofpoint-essentials, node-rootly, node-scalepad, node-threatlocker, node-unitrends

Generated by warden's Gate-3 CWE-250 review, per boss's set-completeness ruling.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a5c70b39-58c7-436f-a0f0-1f23e85dc9d9

📥 Commits

Reviewing files that changed from the base of the PR and between 75db3b1 and e472964.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• CHANGELOG.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[wyre-agent-fleet]

Peer review (comment-only, per the shared-identity self-approval gate).

Verdict: approve, no blockers.

Verified independently against the actual diff content (not just warden's filing summary), as part of the 18-PR CWE-250 follow-up set-review:

• release.yml: adds persist-credentials: false to the release job's actions/checkout step, with the same explanatory comment across all 18 PRs (CWE-250: the release job's contents: write permission makes checkout's default persisted credential write-scoped and live in .git/config through npm ci; persist-credentials: false is semantic-release's own documented recipe since it authenticates pushes via GITHUB_TOKEN directly). The core fix content is byte-identical across the batch -- raw diff size varies only where a repo's pre-existing checkout step used a different YAML style (inline vs multi-line map).
• CHANGELOG.md: entry added under this repo's existing Unreleased section, correct per this repo's own convention.
• No unrelated files touched -- scope is clean.

Full batch (all independently verified): node-axcient#2, node-blumira#41, node-clio#2, node-connectwise-cpq#2, node-datto-bcdr#55, node-datto-saas-protection#55, node-huntress#43, node-iqms#39, node-kaseya-bms#48, node-kaseya-vsa#50, node-mailprotector#2, node-mimecast#44, node-ncentral#4, node-proofpoint-essentials#1, node-rootly#27, node-scalepad#2, node-threatlocker#31, node-unitrends#51

[asachs01]

Review

Change: Adds persist-credentials: false to the actions/checkout step in the release workflow, plus an inline comment explaining the rationale and a CHANGELOG entry.

Correctness: Verified — the release job declares contents: write, which overrides the repo default read-only workflow permission, so the default checkout credential is write-scoped and would otherwise sit in .git/config through npm ci/build/test. Setting persist-credentials: false is the documented semantic-release mitigation (it auths its own pushes via GITHUB_TOKEN), so the fix directly addresses the described CWE-250 exposure with no loss of functionality.

Security: This is the security fix — closes a window where a compromised dependency lifecycle script during npm ci could read a write-scoped git credential off disk. No new secrets, no injection vectors introduced. Correct placement (under the checkout step, before npm ci runs).

Code quality: Minimal, single-purpose diff. Inline comment is clear and justifies the change well.

Tests: No test coverage possible/needed for a workflow-permission change like this; acceptable for CI config.

Docs/changelog: CHANGELOG entry accurately describes the fix and matches the PR description.

No issues found. Approving.

[asachs01]

Code Review Summary — Claude Code

Verdict: Approve

Critical

None

Warnings

None

Suggestions

None

Looks Good

• Minimal, single-purpose diff scoped to .github/workflows/release.yml: adds persist-credentials: false to the actions/checkout step in the release job.
• Root cause correctly identified: the job's contents: write permission overrides the repo's read-only default, so the checkout-persisted credential was write-scoped and lived on disk in .git/config through npm ci, build, and test — a real CWE-250 exposure window if any dependency lifecycle script were compromised.
• Fix is the documented semantic-release recipe: semantic-release authenticates its own pushes via GITHUB_TOKEN and never needed the persisted git credential, so disabling persistence has no functional downside.
• Inline comment explains the "why" clearly for future maintainers.
• CHANGELOG.md updated consistently with the change.
• No test changes needed — this is a CI-config-only fix with no application code impact.

[asachs01]

Reviewed by Claude Code. Adds persist-credentials: false to actions/checkout in the release workflow so the write-scoped git credential (from this job's contents: write permission) no longer lingers in .git/config through npm ci; semantic-release still authenticates pushes via GITHUB_TOKEN, so nothing breaks. Safe and correctly scoped.

[asachs01]

Code Review Summary (Reviewed by Hermes Agent)

Looks Good

• Correctly identifies the gap: the release job's contents: write permission overrides the repo default, so actions/checkout's persisted credential is write-scoped and remains on disk through npm ci/build/test — exploitable by a compromised dependency lifecycle script (CWE-250).
• persist-credentials: false is the right, minimal fix and matches semantic-release's own documented recipe (it authenticates pushes via GITHUB_TOKEN directly, not the persisted git credential).
• Change is scoped to the checkout step only; no functional/build behavior affected.
• CHANGELOG entry documents the change clearly for downstream consumers.

Suggestions

• Consider adding this as a lint/policy check (e.g. a repo-wide CI guard) across the org's other release workflows so the pattern doesn't need to be reintroduced PR-by-PR per repo.

No security regressions introduced; fix closes the stated gap.

[asachs01]

Reviewed against the verified fleet-wide fix pattern: this diff adds persist-credentials: false to the actions/checkout step in .github/workflows/release.yml (with matching CHANGELOG entry), preventing the write-scoped git credential from persisting through npm ci in the release job (CWE-250). semantic-release authenticates its own pushes via GITHUB_TOKEN directly, so this credential was unnecessary and its removal introduces no functional regression. Matches the pattern confirmed in WYRE-AI/node-unitrends#51. Approved.

Reviewed by Hermes Agent

[asachs01]

Review — headRefOid e4729640a55e18f9335055acf2c4da04dc49151e

Scope: CI-only fix, identical pattern to the sibling repos in this set — adds persist-credentials: false to the release workflow's checkout step (CWE-250) plus a CHANGELOG entry.

Critical

• None.

Warnings

• None. Same low-risk, well-justified fix as the other repos in this pattern-set.

Suggestions

• Same note as the sibling PRs: verify no other workflow in this repo (e.g. CI/test workflows, if they also declare elevated permissions) has the same credential-persistence exposure, so the fix is applied everywhere it's needed rather than only in release.yml.

Looks Good

• Correct diagnosis and minimal fix; consistent with the established pattern from node-spanning#46/node-domotz#48 etc.
• CHANGELOG entry accurately documents the security rationale.
• No functional/runtime code touched, no test regression risk.

Verdict: Comment only

[asachs01]

Code Review

Verdict: Approve

Correctness & Security

• Same fix as the identical pattern-set PR across sibling repos: persist-credentials: false added to the release job's checkout, closing the CWE-250 window where a write-scoped contents: write credential otherwise sits in .git/config and is readable by any dependency's install/lifecycle scripts during npm ci/build/test. Correct and minimal.
• semantic-release doesn't need the persisted checkout credential (it authenticates its push directly via GITHUB_TOKEN), so this has no functional downside.

Code Quality

• Good inline comment explaining the specific permission-inheritance mechanism (job-level contents: write overriding the repo's read-only default), not just "security fix" — useful for future readers who might otherwise wonder why this line exists.

Tests / Docs

• No functional code touched, no test impact expected. CHANGELOG.md updated consistently with the sibling PRs in this set.

Nothing blocking. Consistent, low-risk change.

---

Reviewed SHA: e472964

[asachs01]

Claude Code Review

Verdict: Approve

Correctness

Single-line fix: adds persist-credentials: false to the actions/checkout step in the release workflow. Correctly targeted — the release job elevates to contents: write, so the default persisted checkout credential would otherwise be write-scoped and sit in .git/config through npm ci/build/test. semantic-release authenticates its own pushes via GITHUB_TOKEN directly, so nothing downstream needs the persisted credential. No functional regression risk.

Security

This is the security fix (CWE-250 — exposure of sensitive credential to an unauthorized actor/process). Good catch and correct remediation — matches the documented semantic-release GHA pattern.

Code Quality

Inline comment explaining the why (not just the what) is a nice touch — future maintainers won't be tempted to strip it as dead config. Checkout action is pinned to a commit SHA here, which is good supply-chain hygiene (unlike some sibling repos in this pattern-set that use mutable @v4 tags — out of scope for this PR though).

Tests

No tests needed/applicable — this is CI workflow config, not application code.

Docs

CHANGELOG.md updated appropriately under the existing ### Added section for this release.

Looks Good

Minimal, well-scoped, correctly justified fix. Safe to merge.

[asachs01]

Hermes Agent Review

Verdict: Approve

Correct, minimal fix for CWE-250 (write-scoped git credential left live in .git/config through npm ci). persist-credentials: false is the documented semantic-release recipe since it authenticates its own pushes via GITHUB_TOKEN — no functional regression, changelog entry included, scoped to the affected job only.

Looks Good

• Fix is correctly scoped (only the release job, which is the one declaring contents: write)
• Rationale comment inline explains the CWE and why persist-credentials: false is safe here
• Changelog entry present

No blocking issues.

---

Reviewed by Hermes Agent