Force using OpenSource Bot's token

newrelic · Sep 30, 2024 · c5cd3c5 · c5cd3c5
1 parent 1d197b2
commit c5cd3c5
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -18,7 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+        with:
+          # Avoid using GITHUB_TOKEN, instead of the Open Source Bot personal access token.
+          persist-credentials: false
 
       # Probably not necessary since the ubuntu-latest image would have latest Node LTS release
       # and nothing in this job _needs_ older Node
@@ -85,11 +88,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: [job-generate-third-party-notices]
     steps:
-      # Checkout ref: master because previous job committed third_party_notices and
-      # we need to checkout master to pick up that commit
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
+          # Avoid using GITHUB_TOKEN, instead of the Open Source Bot personal access token.
+          persist-credentials: false
+          # Checkout ref: master because previous job committed third_party_notices and
+          # we need to checkout master to pick up that commit
           ref: master
 
       - name: Setup Node.js