SEC: avoid leaking credentials in GHA (#2769)

.github/workflows/release.yml

@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
 
     - uses: hynek/build-and-inspect-python-package@v2
 

.github/workflows/test.yml

@@ -38,6 +38,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v6
       id: python
       with:
@@ -52,6 +54,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v6
       name: Install Python
       with:
@@ -112,6 +116,8 @@ jobs:
     timeout-minutes: 180
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v6
       name: Install Python ${{ matrix.python_version }}
       with:
@@ -240,6 +246,8 @@ jobs:
       archs: ${{ steps.archs.outputs.archs }}
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v6
       with:
         python-version: "3.x"
@@ -263,6 +271,8 @@ jobs:
         arch: ${{ fromJSON(needs.emulated-archs.outputs.archs) }}
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v6
       with:
         python-version: "3.x"
@@ -283,6 +293,8 @@ jobs:
     timeout-minutes: 180
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v6
       name: Install Python 3.12
       with:
@@ -331,6 +343,8 @@ jobs:
           test_select: android
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Download a sample project
       uses: actions/download-artifact@v8
       with:

.github/workflows/update-dependencies.yml

@@ -31,6 +31,8 @@ jobs:
         private-key: ${{ secrets.CIBUILDWHEEL_BOT_APP_PRIVATE_KEY }}
 
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
 
     - uses: wntrblm/nox@2026.02.09
 

.github/workflows/update-major-minor-tag.yml

@@ -22,6 +22,8 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Update the ${{ env.TAG_NAME }} tag
         id: update-major-minor-tag