Add persist-credentials: false to all checkout GHAs

Author: tcompa

.github/workflows/ci_pip.yml

@@ -27,6 +27,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
@@ -60,6 +61,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5

.github/workflows/ci_poetry.yml

@@ -21,6 +21,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Install poetry
         run: pipx install poetry==1.8.2
@@ -66,6 +67,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Install poetry
         run: pipx install poetry==1.8.2
@@ -123,6 +125,8 @@ jobs:
     needs: [tests_core, tests_tasks]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - run: pipx install poetry==1.8.2
       - run: poetry config virtualenvs.in-project true

.github/workflows/documentation.yaml

@@ -15,6 +15,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Deploy docs
         uses: mhausenblas/mkdocs-deploy-gh-pages@master
@@ -29,6 +31,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/manifest_external_packages.yml

@@ -74,6 +74,7 @@ jobs:
         with:
           repository: ${{ matrix.github_repo }}
           ref: ${{ matrix.github_branch }}
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
@@ -90,6 +91,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: fractal-tasks-core
+          persist-credentials: false
 
       - name: Install current fractal-tasks-core (this may fail)
         run: python -m pip install -e ./fractal-tasks-core

.github/workflows/package.yml

@@ -17,6 +17,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Set up Python 3.10
         uses: actions/setup-python@v5

.github/workflows/poetry_build.yml

@@ -11,8 +11,9 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
 
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: "Set up Python 3.10"
         uses: actions/setup-python@v5

.github/workflows/poetry_update.yml

@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install poetry
         run: pipx install poetry==1.8.2
       - uses: actions/setup-python@v5

.github/workflows/publish_pypi.yml

@@ -21,11 +21,11 @@ jobs:
         if: ${{ env.CURRENT_PYPI_TOKEN == '' }}
         run: echo "Secret PYPI_TOKEN is not defined." && exit 1
 
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
-      - name: "Set up Python 3.10"
-        uses: actions/setup-python@v5
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.10"