From 29b395af9aa4744d746d5425af2d6fb00f806469 Mon Sep 17 00:00:00 2001
From: Dmitry Gozman <dgozman@gmail.com>
Date: Tue, 3 Nov 2026 16:35:12 +0000
Subject: [PATCH] devops: add explicit checkout steps to pipelines

---
 .azure-pipelines/publish-docker.yml | 1 +
 .azure-pipelines/publish.yml        | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/.azure-pipelines/publish-docker.yml b/.azure-pipelines/publish-docker.yml
index 48ef7f9a6..53095d1b4 100644
--- a/.azure-pipelines/publish-docker.yml
+++ b/.azure-pipelines/publish-docker.yml
@@ -47,6 +47,7 @@ extends:
         timeoutInMinutes: 360
         steps:
         - checkout: self
+          persistCredentials: false
           displayName: "Checkout code"
 
         - task: UseNode@1
diff --git a/.azure-pipelines/publish.yml b/.azure-pipelines/publish.yml
index 4572d6cd8..c17cd96c3 100644
--- a/.azure-pipelines/publish.yml
+++ b/.azure-pipelines/publish.yml
@@ -36,6 +36,10 @@ extends:
             path: $(Build.ArtifactStagingDirectory)/esrp-build
             artifact: esrp-build
         steps:
+        - checkout: self
+          persistCredentials: false
+          displayName: "Checkout code"
+
         - bash: |
             if [[ ! "$CURRENT_BRANCH" =~ ^v1\..* ]]; then
               echo "Can only publish from a release tag branch (v1.*)."