claude-botandClaude Opus 4.8 01f79b4315 fix(ci): don't persist review_bot_token in the PR checkout config
Replace the credential-in-URL clone (which git wrote into
work/target/.git/config, readable by the review agent whose output is posted
publicly) with a tokenless clone that supplies auth via an HTTP header through
GIT_CONFIG_* env. The persisted remote is tokenless, so no repo file holds the
PAT — fixing the leak at the source instead of deleting .git after the fact.

Supersedes the previous rm -rf .git stopgap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-23 11:54:49 +02:00
S
Description
No description provided
32 MiB
master
Latest
2026-01-31 15:05:31 +00:00
Languages
Go 32.8%
Shell 24.5%
Python 23.8%
Jinja 5.9%
HCL 5.1%
Other 7.8%