👷 Disable checkout credential persistence

Set persist-credentials: false on every actions/checkout step, so the
job token is not left in .git/config for the rest of the job. No step
after checkout pushes or fetches with it. The only authenticated operation,
gh release in release.yml, uses GH_TOKEN.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>

.github/workflows/build-bundle.yml

@@ -56,6 +56,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ inputs.gh_ref }}
 
@@ -123,6 +124,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ inputs.gh_ref }}
 

.github/workflows/build-docker-devenv.yml

@@ -16,6 +16,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

.github/workflows/build-docker.yml

@@ -67,6 +67,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }}
 
@@ -161,6 +162,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }}
 
       - name: Login to Docker Registry

.github/workflows/plugins-deploy-api-doc.yml

@@ -41,6 +41,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ steps.vars.outputs.gh_ref }}
 

.github/workflows/plugins-deploy-package.yml

@@ -60,6 +60,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ inputs.gh_ref }}
 

.github/workflows/plugins-deploy-packages.yml

@@ -37,6 +37,8 @@ jobs:
       #   Add more outputs here
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
       - id: filter
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:

.github/workflows/plugins-deploy-styles-doc.yml

@@ -39,6 +39,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ steps.vars.outputs.gh_ref }}
 

.github/workflows/release.yml

@@ -34,6 +34,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ steps.vars.outputs.gh_ref }}
 

.github/workflows/tests-backend.yml

@@ -61,6 +61,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Fmt
         working-directory: ./backend

.github/workflows/tests-common.yml

@@ -40,6 +40,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Lint
         working-directory: ./common

.github/workflows/tests-e2e.yml

@@ -109,6 +109,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           ref: ${{ inputs.gh_ref }}
 
       # The cache key must come from the SHA actually checked out: on a manual
@@ -165,6 +166,7 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           ref: ${{ inputs.gh_ref }}
 
       - name: Restore Cache
@@ -235,6 +237,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       # The driver serves the prebuilt bundle from frontend/resources/public.
       - name: Restore Cache
@@ -273,6 +277,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       # Mocked mode serves the prebuilt bundle from frontend/resources/public.
       - name: Restore Cache
@@ -320,6 +326,7 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           ref: ${{ inputs.gh_ref }}
 
       - name: Install deps

.github/workflows/tests-exporter.yml

@@ -44,6 +44,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Lint
         working-directory: ./exporter

.github/workflows/tests-frontend.yml

@@ -44,6 +44,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Lint
         working-directory: ./frontend

.github/workflows/tests-library.yml

@@ -42,6 +42,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Lint
         working-directory: ./library

.github/workflows/tests-mcp.yml

@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Setup
         working-directory: ./mcp

.github/workflows/tests-plugins.yml

@@ -39,6 +39,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install deps
         working-directory: ./plugins

.github/workflows/tests-wasm.yml

@@ -40,6 +40,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Format
         working-directory: ./render-wasm

.github/zizmor.yml

@@ -12,26 +12,6 @@ rules:
       - plugins-deploy-api-doc.yml
       - plugins-deploy-package.yml
       - plugins-deploy-styles-doc.yml
-  # Use `persist-credentials: false` in actions/checkout.
-  artipacked:
-    ignore:
-      - build-bundle.yml
-      - build-docker-devenv.yml
-      - build-docker.yml
-      - plugins-deploy-api-doc.yml
-      - plugins-deploy-package.yml
-      - plugins-deploy-packages.yml
-      - plugins-deploy-styles-doc.yml
-      - release.yml
-      - tests-backend.yml
-      - tests-common.yml
-      - tests-e2e.yml
-      - tests-exporter.yml
-      - tests-frontend.yml
-      - tests-library.yml
-      - tests-mcp.yml
-      - tests-plugins.yml
-      - tests-wasm.yml
   # Avoid restoring caches in release/publish workflows.
   cache-poisoning:
     ignore: