Set permissions and forget credentials after clone in regular workflow

Author: colindean

.github/workflows/make-based-ci.yml

@@ -10,6 +10,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   poetry-checks:
     runs-on: ubuntu-latest
@@ -36,6 +38,8 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      with:
+        persist-credentials: false
 
     - name: Set up Homebrew
       id: set-up-homebrew