ci: Remove persist-credentials from our CI workflows

This mitigates a potential security risk identified by zizmor.

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 680bc2c23e6825dc3ab621c108cd229696b2b0e1..3308fb72f7c342e8d91843bd7cdb46939b474e94 100644 (file)
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,6 +26,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         name: Install Python
         with:
@@ -51,6 +53,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         name: Install Python
         with:

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e947689c364f8203a26f682aa64f8afcbabe1b77..2ec16083b602f548e313e641ef850f096833dffd 100644 (file)
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,6 +18,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         name: Install Python
         with:
@@ -65,6 +67,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         name: Install Python
         with:
@@ -88,6 +92,8 @@ jobs:
     runs-on: windows-2022
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         name: Install Python
         with: