From 6e233db087d9ae1f6acfe26864397ba93ab012f0 Mon Sep 17 00:00:00 2001
From: L1ghtn1ng <jay@cybermon.uk>
Date: Mon, 6 Jul 2026 21:53:04 +0100
Subject: [PATCH] harden github actions more

---
 .github/dependabot.yml                  | 6 +++---
 .github/workflows/codeql-analysis.yml   | 2 ++
 .github/workflows/dependency-review.yml | 2 ++
 .github/workflows/docker-build-push.yml | 2 ++
 .github/workflows/dockerci.yml          | 2 ++
 .github/workflows/theHarvester.yml      | 2 ++
 6 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bfd7df6c..94c82d73 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,7 +13,7 @@ updates:
     interval: daily
     timezone: Europe/London
   cooldown:
-    default-days: 5
+    default-days: 7
   patterns: ["*"]
   multi-ecosystem-group: all-dependencies
 - package-ecosystem: uv
@@ -22,7 +22,7 @@ updates:
     interval: daily
     timezone: Europe/London
   cooldown:
-    default-days: 5
+    default-days: 7
   patterns: ["*"]
   multi-ecosystem-group: all-dependencies
   allow:
@@ -34,6 +34,6 @@ updates:
   schedule:
     interval: daily
   cooldown:
-    default-days: 5
+    default-days: 7
   patterns: ["*"]
   multi-ecosystem-group: all-dependencies
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 13aa8b2c..ac0589fb 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,6 +48,8 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 818143bf..2083cd5d 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -23,5 +23,7 @@ jobs:
 
       - name: 'Checkout Repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index eee0b032..fff19b55 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -21,6 +21,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
diff --git a/.github/workflows/dockerci.yml b/.github/workflows/dockerci.yml
index 3a92b35a..44f60552 100644
--- a/.github/workflows/dockerci.yml
+++ b/.github/workflows/dockerci.yml
@@ -15,6 +15,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Build the Docker image
         run: docker build --tag theharvester .
       - name: Smoke test
diff --git a/.github/workflows/theHarvester.yml b/.github/workflows/theHarvester.yml
index 5f78ce72..60fb18c3 100644
--- a/.github/workflows/theHarvester.yml
+++ b/.github/workflows/theHarvester.yml
@@ -25,6 +25,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with: