Remove token after checkout

Author: kezhenxu94

.github/workflows/CI.yaml

@@ -39,6 +39,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
       - name: Check License
         uses: apache/skywalking-eyes/header@501a28d2fb4a9b962661987e50cf0219631b32ff
       - name: Set up Python
@@ -61,6 +62,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -82,6 +84,8 @@ jobs:
       agent: ${{ steps.filter.outputs.agent }}
     steps:
       - uses: actions/checkout@v4  # required for push event
+        with:
+          persist-credentials: false
       - name: Check for file changes
         uses: getsentry/[email protected]
         id: filter
@@ -116,6 +120,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - id: set-matrix
         run: |
           sudo apt-get install jq
@@ -142,6 +148,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
       - name: Build SkyWalking Python agent base plugin image
         run: |
           docker build --build-arg BASE_PYTHON_IMAGE -t apache/skywalking-python-agent:latest-plugin --no-cache . -f tests/plugin/Dockerfile.plugin
@@ -175,6 +182,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
       - name: Install docker-compose
         shell: bash
         if: runner.os != 'Windows'
@@ -221,6 +229,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
       - name: Build SkyWalking Python agent base e2e image
         run: |
           docker build --build-arg BASE_PYTHON_IMAGE -t apache/skywalking-python-agent:latest-e2e --no-cache . -f tests/e2e/base/Dockerfile.e2e
@@ -273,6 +282,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
       - name: Pull SkyWalking Python agent base image
         uses: actions/download-artifact@v4
         with:

.github/workflows/dead-link-checker.yaml

@@ -36,6 +36,8 @@ jobs:
     if: (github.event_name == 'schedule' && github.repository == 'apache/skywalking-python') || (github.event_name != 'schedule')
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: gaurav-nelson/github-action-markdown-link-check@v1
         with:
           use-quiet-mode: 'no'

.github/workflows/publish-docker.yaml

@@ -37,6 +37,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: true
+          persist-credentials: false
       - name: Set environment variables
         run: |
           if [[ ${{ github.event_name }} == "release" ]]; then