From b11520f04e36d30cd6c7bcaa205b4801bbc5b9be Mon Sep 17 00:00:00 2001
From: Matt Sutkus <97645156+msuitcase@users.noreply.github.com>
Date: Fri, 9 Oct 2026 01:30:23 -0700
Subject: [PATCH] ci: don't persist GITHUB_TOKEN in checkout

actions/checkout writes the job token into .git/config by default, where
any later step (npm install lifecycle scripts, build, tests, publish) can
read it. Nothing in these workflows needs git credentials after
checkout; the gh-pages deploy and release asset upload take the token
through their own inputs.

Refs SEC-847
---
 .github/workflows/ci.yml      | 12 ++++++++++++
 .github/workflows/release.yml |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f48364f3..34ec96510 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v4
       - uses: actions/setup-node@v7
         with:
@@ -26,6 +28,8 @@ jobs:
         node-version: [18.x, 20.x, 22.x, 24.x, 26.x]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v4
       - uses: actions/setup-node@v7
         with:
@@ -40,6 +44,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v4
       - uses: actions/setup-node@v7
         with:
@@ -49,6 +55,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v4
       - uses: actions/setup-node@v7
         with:
@@ -58,6 +66,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v4
       - uses: actions/setup-node@v7
         with:
@@ -74,6 +84,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v4
       - uses: actions/setup-node@v7
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 924e46f8e..28d61055f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v3
       - uses: actions/setup-node@v7
         with: