[V3RON]

Summary

Two CI hardening fixes. The Release workflow no longer puts GITHUB_TOKEN in the push URL. The website job now installs dependencies with --ignore-scripts, like every other job. The Playwright browser installs stay as they are (see Verified).

Changes

• .github/workflows/release.yml (Push step): the remote is now plain https://github.com/${GITHUB_REPOSITORY}.git. The token goes as an AUTHORIZATION: basic base64(x-access-token:<token>) extraheader. It is set through git's GIT_CONFIG_COUNT / GIT_CONFIG_KEY_0 / GIT_CONFIG_VALUE_0 environment variables, not git -c. A -c value still lands in git's argv, so the base64 credential would show in the process list just like the old URL did. The base64 value is also passed to ::add-mask::, because Actions masks only the raw token. --atomic, --force-with-lease="refs/heads/main:$GITHUB_SHA" and the existing # why: comment are kept, and a # why: line explains the new form.
• .github/workflows/website.yml: pnpm install --frozen-lockfile becomes pnpm install --frozen-lockfile --ignore-scripts.
• src/source-hygiene.test.ts: new checks over every tracked workflow. Every pnpm install must pass --ignore-scripts. No URL may hold a credential (scheme://…@). The Release push must send the token through the GIT_CONFIG_* extraheader, keep it out of the git push command, and keep --atomic, the lease and the commit+tag refspecs. All checks failed on main's workflows and pass now.

Verified

• Header form, checked against actions/checkout's source. src/git-auth-helper.ts at v7.0.1, the version this repo pins, does this: config key http.${serverUrl.origin}/.extraheader, value AUTHORIZATION: basic ${base64("x-access-token:" + token)}, and core.setSecret on the base64 value. Our key, value and masking match. One difference: checkout writes the header into the local git config file, while this step passes it through the environment, so nothing is left on disk.
• The env-var form works. I ran a local HTTP server that logs the Authorization header and ran git push (git 2.53) with only the GIT_CONFIG_* variables set. The server got basic eC1hY2Nlc3MtdG9rZW46ZmFrZS10b2tlbi0xMjM=, which decodes to x-access-token:fake-token-123. GIT_CONFIG_COUNT needs git 2.31 or later; ubuntu-24.04 runners ship a newer git.
• The website builds without install scripts. pnpm --dir website install --frozen-lockfile --ignore-scripts && pnpm --dir website build && node website/scripts/check-openapi.mjs, run on a fresh website/node_modules: 72 pages built, and check-openapi: 30 operations, 9 tags: ok. sharp, esbuild and astro needed no install script. Note that website/pnpm-workspace.yaml has no allowBuilds, so pnpm 11 was already skipping dependency build scripts there. The flag mostly makes this explicit and matches the other jobs.
• Playwright (ci.yml and real-proxy.yml playwright install --with-deps chromium, unchanged). pnpm-lock.yaml locks playwright / playwright-core at 1.63.0. The browsers.json in that package fixes Chromium at revision 1243 (Chrome for Testing 153.0.8010.12), and playwright install --dry-run chromium resolves exactly that build. So the browser follows the locked version. The apt packages from --with-deps stay unpinned, which is expected.
• pnpm exec vitest run --project unit src/source-hygiene.test.ts: 16 passed. pnpm test:changed: 16 passed. The commit hook passed (comments, lint, format, boundaries, typecheck).

Assumptions

• Assumption: I passed the credential through GIT_CONFIG_* environment variables instead of the suggested git -c "http…extraheader=…". The -c form would still put the base64 token in git's argv, which is the exposure this change removes.
• Assumption: nothing to change for the Playwright installs; this PR only records why.

Written by an agent.

[V3RON]

Review (maintainer's agent, round 1)

No blocking findings.

• The GIT_CONFIG_* form is right and better than the git -c form the brief suggested: the credential is in neither the URL nor argv, and ::add-mask:: covers the base64 value that Actions would otherwise print. Key and value match actions/checkout v7.0.1's git-auth-helper.ts.
• --ignore-scripts on the website install is proven by a fresh build (72 pages, check-openapi ok); pnpm 11 already skipped dependency builds there without allowBuilds, so this is explicitness, not a behaviour change.
• Tests pin the shape that matters (no credential in any workflow URL, every pnpm install without scripts, the push step's header plumbing and its --atomic lease) and fail on main.

Notes, no change needed: the Playwright browser revision follows the locked playwright 1.63.0 as stated; apt packages from --with-deps stay unpinned by nature.