ci(security): avoid persisting credentials on checkout (#24)

Author: JonZeolla

.github/workflows/ci.yml

@@ -28,6 +28,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:
@@ -47,13 +49,15 @@ jobs:
         if: github.event_name != 'pull_request'
         with:
           fetch-depth: 0
+          persist-credentials: 'false'
       - name: Checkout the repository
         uses: actions/checkout@v4
         # Necessary for hooks to succeed during tests for PRs
         if: github.event_name == 'pull_request'
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:

.github/workflows/release.yml

@@ -26,6 +26,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: 'false'
 
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap

.github/workflows/security.yml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:

.github/workflows/update.yml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:

{{cookiecutter.project_name|replace(" ", "")}}/.github/workflows/ci.yml

@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:
@@ -49,6 +51,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:
@@ -69,6 +73,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:

{{cookiecutter.project_name|replace(" ", "")}}/.github/workflows/commit.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:
@@ -41,6 +43,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:
@@ -116,6 +119,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: "${{ "{{ needs.bump-version.outputs.tag }}" }}"
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:

{{cookiecutter.project_name|replace(" ", "")}}/.github/workflows/security.yml

@@ -31,6 +31,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with:

{{cookiecutter.project_name|replace(" ", "")}}/.github/workflows/update.yml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
       - name: Bootstrap repository
         uses: ./.github/actions/bootstrap
         with: