CWE-522: anchor-drift.yml persists credentials on all six checkout steps (fix in PR #55) #53

What shipped

PR #52 was merged at 2026-09-09T09:00:03Z carrying an unfixed CWE-522 finding.
This is not a regression introduced by that PR — the finding pre-existed it — but
the PR was the vehicle that was supposed to fix it, and the fix did not land.

Measured on main after the merge

.github/workflows/anchor-drift.yml has five actions/checkout steps and zero
persist-credentials lines, so all five fall back to the default
persist-credentials: true.

Verified against a positive control rather than by absence alone: the prepared
fix patch greps 6 occurrences of persist-credentials; main greps 0.

Why the fix is not in the PR

The fix commit 6a5d1a7 exists but was rejected at push time:

! [remote rejected] (refusing to allow an OAuth App to create or update workflow
  '.github/workflows/anchor-drift.yml' without 'workflow' scope)

The acting token carries scopes gist, read:org, repo — no workflow. The
rejection is per-commit and fails the whole push, so the validator commit
bc16497 landed while the workflow commit did not. That asymmetry is why the PR
looked complete.

The fix

Preserved as a patch at:

developer/archive/2026-09-08-drain/merge-run-2026-09-09/pending-patches/0002-ci-anchor-drift-stop-persisting-credentials-on-check.patch

It adds to each checkout step:

        with:
          # No job here pushes or uses the token; this workflow runs on
          # pull_request and executes repository-controlled code, so the
          # default credential persistence in .git/config is exposure with
          # no upside (CWE-522).
          persist-credentials: false

Unblocking

One owner command: gh auth refresh -h github.com -s workflow

The same missing scope also blocks two CWE-522 findings and one
permissions: read-all finding (githubactions:S8234) on hyperpolymath/a2ml#3
— where that last one is the sole cause of a red SonarCloud quality gate.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QNjWX2B4FffG7zqMBMui6v