From fded9949af695caaa8decce10f59048fb232f983 Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Thu, 8 Oct 2026 13:40:30 +0000
Subject: [PATCH] ci: stop exposing the checkout token and the keystore to
 later steps

Set persist-credentials: false so the contents:write token is not left
in .git/config where every later step (including the Gradle build) could
read it, and delete the decoded keystore once signing is done.
---
 .github/workflows/build-next.yml | 2 ++
 .github/workflows/release.yml    | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/build-next.yml b/.github/workflows/build-next.yml
index 6a5cb1da..9219b8d8 100644
--- a/.github/workflows/build-next.yml
+++ b/.github/workflows/build-next.yml
@@ -16,6 +16,8 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
       - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d5aae81e..48dcb4b5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,8 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
       - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
         with:
@@ -40,6 +42,9 @@ jobs:
           RELEASE_KEY_ALIAS: ${{ steps.signing.outputs.alias }}
           RELEASE_KEY_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_KEY_PASSWORD }}
         run: nix develop --command gradle :app:assembleRelease :app:bundleRelease --no-daemon
+      - name: Remove signing keystore
+        if: always()
+        run: rm -f "$RUNNER_TEMP/release.keystore"
       - name: Read version code
         id: version
         run: echo "code=$(grep -oP 'versionCode = \K\d+' app/build.gradle.kts)" >> "$GITHUB_OUTPUT"