[aw-compat] Codemod proposal: auto-add 'with: persist-credentials: false' to actions/checkout in user steps

[github-actions]

Motivation

In today's cross-repo audit (2 of 20 repos), workflows with custom steps: blocks that include actions/checkout fail with:

error: strict mode: actions/checkout step(s) without 'persist-credentials: false' detected in the agent job: 'Checkout repository'. Without this setting the git token is stored in .git/config and leaked to the agent. Add 'persist-credentials: false' to the 'with:' block of each checkout step.

This fails even without --strict (it's a default check) and the fix is mechanical, so it is an excellent codemod candidate.

Affected repos in this audit

• githubnext/gh-aw-trial-oxpecker-test — .github/workflows/daily-test-improver.md
• githubnext/gh-aw-trial-FSharpStats-copilot-cli — .github/workflows/daily-test-improver.md

Both come from a daily-test-improver template that has not yet been patched.

Example

Before:

steps:
  - name: Checkout repository
    uses: actions/checkout@v5

After:

steps:
  - name: Checkout repository
    uses: actions/checkout@v5
    with:
      persist-credentials: false

Codemod sketch

• ID: checkout-persist-credentials-false
• Scans the steps: block in workflow frontmatter for any uses: actions/checkout@* step.
• If the step has no with: block, adds with: { persist-credentials: false }.
• If the step has a with: block but no persist-credentials key, adds persist-credentials: false to it.
• If persist-credentials: true is set explicitly, emits a warning instead of mutating (user has explicitly opted in).

Considerations

• This codemod should also cover pre-steps: and post-steps: if they are introduced in the same workflows.
• For nested checkouts inside if-guarded steps, the codemod should still apply.
• The same logic could also patch the upstream daily-test-improver template in github/gh-aw so newly minted trial repos don't regress.

Acceptance criteria

• New codemod registered in the fix registry with description and IntroducedIn set to the current release
• Running gh aw fix --write on a fresh clone of githubnext/gh-aw-trial-oxpecker-test makes the workflow compile cleanly
• Unit fixtures added for the with-block / no-with-block / explicit-true cases

References:

• §25663182363
• See parent issue: #31473

Generated by Daily AW Cross-Repo Compile Check · ● 42.6M · ◷

• expires on May 18, 2026, 10:56 AM UTC