[build] Configured all checkouts to NOT persist the credentials (#1901)

Configured all checkouts to NOT persist the credentials

Signed-off-by: Roland Asmann <[email protected]>

Author: malice00

.github/workflows/binary-builds.yml

@@ -141,6 +141,8 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup alpine builder
         run: |
           apk add --no-cache nodejs make python3 python3-dev py3-pip py3-virtualenv gcc g++ musl-dev npm
@@ -267,6 +269,8 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:

.github/workflows/dockertests.yml

@@ -20,6 +20,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
@@ -49,6 +51,7 @@ jobs:
           CDXGEN_TEMP_DIR: ${{ runner.temp }}/cdxgen-dockertests
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'grafana-operator/grafana-operator'
           path: 'repotests/grafana-operator'
       - name: dockertests
@@ -98,6 +101,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
@@ -146,6 +151,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
@@ -190,6 +197,8 @@ jobs:
         java-version: ['24']
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:

.github/workflows/image-build.yml

@@ -27,6 +27,8 @@ jobs:
     runs-on: ${{ fromJSON(inputs.image).runner || 'ubuntu-24.04' }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Free disk space
         if: ${{ ! fromJSON(inputs.image).runner }}
         uses: jlumbroso/free-disk-space@main

.github/workflows/java-reachables-test.yml

@@ -16,6 +16,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
@@ -34,11 +36,13 @@ jobs:
           mkdir -p bomresults
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'DependencyTrack/dependency-track'
           path: 'repotests/dependency-track'
           ref: '4.11.1'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'DependencyTrack/frontend'
           path: 'repotests/frontend'
           ref: '4.13.0'
@@ -69,17 +73,21 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: setup paths
         run: |
           mkdir -p repotests
           mkdir -p rubyresults
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'bionomia/bionomia'
           path: 'repotests/bionomia'
           ref: '5ada8b5f4a5f68561a7195e2badc2f744dc4676e'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'OWASP/railsgoat'
           path: 'repotests/railsgoat'
           ref: 'c1e8ff1e3b24a1c48fcfc9fbee0f65dc296b49d9'
@@ -108,8 +116,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'playframework/play-samples'
           path: 'repotests/play-samples'
           ref: '0dccba17856e89dbb5e457ab760efb14cc691395'

.github/workflows/lint.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc

.github/workflows/nodejs.yml

@@ -21,6 +21,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -72,6 +74,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
@@ -123,6 +127,8 @@ jobs:
     runs-on: ${{ matrix.os }}-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -149,6 +155,8 @@ jobs:
         os: [macos-latest]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Trim CI agent
         run: |
           chmod +x contrib/free_disk_space.sh

.github/workflows/npm-release.yml

@@ -26,6 +26,8 @@ jobs:
       id-token: write
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Use Node.js
       uses: actions/setup-node@v4
       with:
@@ -68,6 +70,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
@@ -111,6 +115,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
@@ -156,6 +162,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
       - uses: docker/login-action@v3
         with:
@@ -184,6 +191,8 @@ jobs:
       id-token: write
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Use Node.js
       uses: actions/setup-node@v4
       with:
@@ -265,6 +274,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -333,6 +344,8 @@ jobs:
       id-token: write
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Use Node.js
       uses: actions/setup-node@v4
       with:
@@ -401,6 +414,8 @@ jobs:
       id-token: write
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Use Node.js
       uses: actions/setup-node@v4
       with:
@@ -451,6 +466,8 @@ jobs:
       id-token: write
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Use Node.js
       uses: actions/setup-node@v4
       with:

.github/workflows/nydus-demo.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
@@ -24,6 +26,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'DependencyTrack/dependency-track'
           path: 'repotests/dependency-track'
       - name: setup nydus

.github/workflows/python-atom-tests.yml

@@ -12,6 +12,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
       - uses: coursier/cache-action@v6
       - name: Use Node.js
@@ -34,35 +35,43 @@ jobs:
           CI: true
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'scipy/scipy'
           path: 'repotests/scipy'
           ref: 'v1.15.2'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'psf/black'
           path: 'repotests/black'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'psf/pyperf'
           path: 'repotests/pyperf'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'psf/cachecontrol'
           path: 'repotests/cachecontrol'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'pallets/flask'
           path: 'repotests/flask'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'pallets/click'
           path: 'repotests/click'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'pallets/jinja'
           path: 'repotests/jinja'
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: 'pypa/bandersnatch'
           path: 'repotests/bandersnatch'
       - name: repotests