github/workflows: disable persisting credentials for actions/checkout

Set `persist-credentials: false` for actions/checkout. By default, using `actions/checkout` causes a credential to be persisted on disk. Subsequent steps may accidentally publicly persist the credential, e.g. by including it in a publicly accessible artifact via actions/upload-artifact. However, even without this, persisting the credential on disk is non-ideal unless actually needed. Link: https://docs.zizmor.sh/audits/#artipacked
2026-02-18 08:00:00 +00:00
parent 31fc68a69a
commit 6461eccacb
13 changed files with 23 additions and 0 deletions
@@ -43,6 +43,8 @@ jobs:
    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      with:
+        persist-credentials: false

    - name: Initialize CodeQL
      uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30