Set persist-credentials: false on checkout steps (PM_GH_REPO_036)

[anish-sujanani]

Set persist-credentials: false on checkout steps

Addresses PM_GH_REPO_036 — actions/checkout must not persist credentials.

By default actions/checkout writes the job's GITHUB_TOKEN into the local git config as an
http.https://github.com/.extraheader entry and leaves it there for the rest of the job. Any
later step running in the workspace can read it — a dependency postinstall, a test helper,
an uploaded artifact, a verbose log. persist-credentials: false makes checkout remove it
once the clone is done.

This sets the key on 5 steps.

Why this does not break the checkout itself

actions/checkout authenticates, clones, and then scrubs: configureAuth() runs
unconditionally and the removal happens in a finally block after the fetch. Checkout's own
network access is unaffected, including on private repositories and with fetch-depth: 0.

Each job here was checked for anything that consumes the credential afterwards: every run:
command, every script and npm/make target those commands invoke, and every uses: action
resolved at its pinned ref with both src/ and dist/ read, recursing through composites.
Jobs that reach the network with git were excluded rather than changed.

gh is unaffected — it reads GH_TOKEN/GITHUB_TOKEN from the environment and uses the REST
API. Only a git subprocess doing network I/O from inside the workspace is affected.

Verification

• The parsed YAML is identical before and after with the added key stripped.
• The diff adds only with: and persist-credentials: false lines and deletes nothing.
• Inserted keys equal the checkout steps that lacked the key, minus the excluded jobs,
  checked per file.
• actionlint reports the same findings before and after.

Break risk

Low. If a job here turns out to run git against the network in a way I missed, the symptom
is an authentication failure on that one command — loud, immediate, and fixed by reverting
the key on that step.

[nitpickybot]

Adds persist-credentials: false to five actions/checkout steps across four workflows. YAML indentation is consistent with each surrounding block, and none of the touched jobs appear to need the persisted token for later git network operations. No actionable findings.

Review Scope

• Mode: Full pull request
• Range: Full pull request through cd9d1bd2891090e21dbfa128d21e5e79a31567f6
• Current range coverage: Complete
• Cumulative pull request coverage: Complete

---

This review is complete for the current scope. Addressing all critical and warning findings above satisfies the review; suggestions are optional. Request another review only if subsequent changes introduce new behavior or materially expand the pull request's scope.