GHA: Migrate to actions/checkout@v4

Author: dmach

.github/workflows/build-install.yaml

@@ -76,9 +76,10 @@ jobs:
             rpm -q dnf5 >/dev/null || dnf -y install dnf-plugins-core || :
             rpm -q dnf5 >/dev/null && dnf -y install dnf5-plugins || :
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
             fetch-depth: 0
+            persist-credentials: false
 
       - name: 'Install build dependencies (OpenSUSE/SLE)'
         if: ${{ contains(matrix.container, '/opensuse/') || contains(matrix.container, '/bci/bci-base') }}
@@ -129,7 +130,9 @@ jobs:
             sudo apt-get -y upgrade
             sudo apt-get -y --no-install-recommends install git python3-pip python3-rpm
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Install osc from pip'
         run: |
@@ -152,7 +155,9 @@ jobs:
             sudo apt-get -y update
             sudo apt-get -y --no-install-recommends install git python3-pip python3-rpm python3-virtualenv
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Initialize virtualenv'
         run: |

.github/workflows/codeql.yml

@@ -29,7 +29,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2

.github/workflows/container-image.yaml

@@ -20,7 +20,9 @@ jobs:
           echo "$GHCR_TOKEN" | podman login ghcr.io -u "$GHCR_USER" --password-stdin
 
       - name: "Checkout sources"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       # This step is necessary to avoid the following error during podman build:
       # (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:80

.github/workflows/linters.yaml

@@ -16,7 +16,9 @@ jobs:
   mypy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v4
       - run: pip config set global.break-system-packages 1
       - run: pip install mypy
@@ -27,9 +29,10 @@ jobs:
   darker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@v4
       - uses: akaihola/[email protected]
         with:
@@ -48,7 +51,9 @@ jobs:
             sudo pip3 config set global.break-system-packages 1
             sudo pip3 install pylint
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Run pylint --errors-only'
         run: |
@@ -77,19 +82,22 @@ jobs:
             sudo pip3 config set global.break-system-packages 1
             sudo pip3 install pylint
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: osc-pr
+          persist-credentials: false
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: osc-master
+          persist-credentials: false
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           repository: ${{ matrix.plugin_repository }}
           path: plugin
+          persist-credentials: false
 
       - name: 'Install dependencies from pip'
         run: |

.github/workflows/pypi.yaml

@@ -16,6 +16,8 @@ jobs:
       id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Python 3.12
         uses: actions/setup-python@v5
         with:

.github/workflows/tests.yaml

@@ -28,7 +28,9 @@ jobs:
             sudo apt-get -y --no-install-recommends install git-lfs
             sudo apt-get -y --no-install-recommends install diffstat diffutils git-core python3 python3-cryptography python3-pip python3-rpm python3-ruamel.yaml python3-setuptools python3-urllib3
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Change owner to root:root'
         run: |
@@ -114,7 +116,9 @@ jobs:
             apt-get -y --no-install-recommends install git-lfs
             apt-get -y --no-install-recommends install diffstat diffutils git-core python3 python3-cryptography python3-pip python3-rpm python3-ruamel.yaml python3-setuptools python3-urllib3
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Run unit tests'
         run: |
@@ -153,7 +157,9 @@ jobs:
             sudo ln -s /usr/local/lib/*/*/obs_scm_bridge /usr/lib/obs/service/obs_scm_bridge
 
       - name: "Checkout sources"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: "Pull container image"
         run: |