ci: stop actions/checkout from persisting credentials

By default, `actions/checkout` persists the job's `GITHUB_TOKEN` so
later Git commands can use it. Since v6, it writes the token to a
credentials file under `$RUNNER_TEMP` and adds `includeIf` entries
that include that file to the checked-out repository's `.git/config`.
Nine checkout steps did this, in `alpine-test.yml`, `codeql.yml`,
`cygwin-test.yml`, `dependencies.yml`, `git-cli.yml` (twice, including
the `git/git` checkout in `.git-source`), `lint.yml`, and
`pythonpackage.yml` (twice). zizmor reports these as `artipacked`.

No step in these jobs needs the token after checkout. They push
nothing, and their only network Git operations are reads of public
repositories, which need no credentials. The other checkouts, in
`backend-benchmark.yml`, `downstream.yml`, the `uv-sync` job in
`dependencies.yml`, and `zizmor.yml`, already use
`persist-credentials: false`.

Keeping the token is also riskier here than in most projects. GitPython
runs Git operations, and its test suite uses this checkout as a
repository: the tests read it, clone it, and run Git commands against
it. A test or library bug could then use the token, or expose the
configuration that refers to it, whether through test output or a
retained artifact such as `pythonpackage.yml`'s test results. The
`includeIf` entries and the configuration they include can also
change how Git behaves in it, coupling test results to how CI checked
out the code.

Set `persist-credentials: false` on every checkout that lacked it. It
is added to the existing `with:` block where there is one, after the
other inputs, as in `backend-benchmark.yml`. The disabled
`codeql.yml` workflow is included, so it is safe if it is enabled
again.

zizmor 1.31.1 at the `pedantic` level no longer reports any
`artipacked` findings. `actionlint` reports no problems.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: EliahKagan

.github/workflows/alpine-test.yml

@@ -35,6 +35,7 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Set workspace ownership
       run: |

.github/workflows/codeql.yml

@@ -49,6 +49,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/cygwin-test.yml

@@ -31,6 +31,7 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Install Cygwin
       uses: cygwin/cygwin-install-action@3f0a3f9f988f7e96b8c18098ae05eaec175f5b52 # v6.0.2

.github/workflows/dependencies.yml

@@ -28,6 +28,7 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        persist-credentials: false
     - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: ${{ matrix.python-version }}

.github/workflows/git-cli.yml

@@ -16,11 +16,14 @@ jobs:
       GIT_PYTHON_BACKEND: cli
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: git/git
           ref: v2.52.0
           path: .git-source
+          persist-credentials: false
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'

.github/workflows/lint.yml

@@ -15,6 +15,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:

.github/workflows/pythonpackage.yml

@@ -62,6 +62,7 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
@@ -266,6 +267,8 @@ jobs:
       GIT_PYTHON_BACKEND: cli
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: ${{ matrix.python }}