ci: fail if any actions/checkout step persists credentials

Every `actions/checkout` step now sets `persist-credentials: false`.
zizmor reports any that do not as `artipacked`, but only as code
scanning alerts: it does not fail CI. A checkout that persists the
`GITHUB_TOKEN` should fail CI, because it is riskier in this
repository than in most. GitPython performs Git operations, and its
test suite reads, clones, and runs Git commands against the
repository it is tested in. That coupling may be intended or not, and
it can let a test or library bug use or expose a persisted token.

Add a `check-no-persist-credentials` job to the `Lint` workflow. It
sparse-checks out `.github/workflows`, without persisting credentials
itself, and uses `yq` to list every step in every workflow file that
uses `actions/checkout` without `persist-credentials: false`. This
includes a step with no `with:` block, a `with:` block without the
input, and any other value. The job fails if anything is listed and
prints each match as `file:line: name`.

This is the same code as the job of the same name in gitoxide's CI
(`.github/workflows/ci.yml`), copied from its current version. The
only change is indentation, to match the step style of `lint.yml`.
gitoxide's job also gates its `tests-pass` job, but this repository
has no such aggregate job.

The check does not replace zizmor's `artipacked` audit, which also
looks for ways persisted credentials could end up in uploaded
artifacts, and whose findings are tracked as code scanning alerts.

Run locally with `yq` 4.54.1, the scan reports nothing for the
workflows in this commit. In a scratch copy, removing the setting
from both checkouts in `pythonpackage.yml` (one with other inputs and
one with no `with:` block) and setting it to `true` in `lint.yml`
made it report exactly those four steps and fail. A quoted `"false"`
is not reported, which is correct, since action inputs are strings
and `actions/checkout` treats it the same as `false`.

`actionlint` reports two `info`-level SC2086 notes from `shellcheck`,
for the unquoted `$GLOB`. Pathname expansion there is intended, as the
inline comments say, so they are left as they are in gitoxide.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: EliahKagan

.github/workflows/lint.yml

@@ -23,3 +23,30 @@ jobs:
         python-version: "3.x"
 
     - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+
+  # Check that all `actions/checkout` in CI jobs have `persist-credentials: false`.
+  check-no-persist-credentials:
+    runs-on: ubuntu-slim
+
+    env:
+      GLOB: .github/workflows/*.@(yaml|yml)
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+        sparse-checkout: ".github/workflows"
+    - name: List workflows to be scanned
+      run: |
+        shopt -s extglob
+        printf '%s\n' $GLOB  # Pathname expansion in $GLOB intended.
+    - name: Scan workflows
+      run: |
+        shopt -s extglob
+        yq '.jobs.*.steps[]
+          | select(.uses == "actions/checkout@*" and .with.["persist-credentials"]? != false)
+          | {"file": filename, "line": line, "name": (.name // .uses)}
+          | .file + ":" + (.line | tostring) + ": " + .name
+        ' -- $GLOB >query-output.txt  # Pathname expansion in $GLOB intended.
+        cat query-output.txt
+        test -z "$(<query-output.txt)"  # Report failure if we found anything.