From cd9d1bd2891090e21dbfa128d21e5e79a31567f6 Mon Sep 17 00:00:00 2001
From: Anish Sujanani <anish.sujanani@postman.com>
Date: Thu, 17 Sep 2026 10:58:00 +0530
Subject: [PATCH] Set persist-credentials: false on actions/checkout

actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting
persist-credentials: false removes it, as defence in depth against a later step
exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036.
---
 .github/workflows/check_spec.yaml  | 2 ++
 .github/workflows/lint.yaml        | 4 ++++
 .github/workflows/publish_sdk.yaml | 2 ++
 .github/workflows/test.yaml        | 2 ++
 4 files changed, 10 insertions(+)

diff --git a/.github/workflows/check_spec.yaml b/.github/workflows/check_spec.yaml
index dd9d409..ed02bd9 100644
--- a/.github/workflows/check_spec.yaml
+++ b/.github/workflows/check_spec.yaml
@@ -12,6 +12,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python 3.11
       uses: actions/setup-python@v4
       with:
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 3a16efb..b5a366a 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -9,6 +9,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v3
+      with:
+        persist-credentials: false
     - name: Set up Python 3.11
       uses: actions/setup-python@v4
       with:
@@ -26,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - uses: psf/black@stable
         with:
           options: "--check --verbose"
diff --git a/.github/workflows/publish_sdk.yaml b/.github/workflows/publish_sdk.yaml
index 7a9f0db..ec15de8 100644
--- a/.github/workflows/publish_sdk.yaml
+++ b/.github/workflows/publish_sdk.yaml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Setup Node.js environment
         uses: actions/setup-node@v3
         with:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 9c0e2d9..6423516 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -9,6 +9,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v3
+      with:
+        persist-credentials: false
     - name: Set up Python 3.11
       uses: actions/setup-python@v4
       with: