Use persist-credentials: false in GHAs

.github/workflows/ci.yml

@@ -25,6 +25,8 @@ jobs:
           sudo --login -u postgres psql -c "ALTER USER postgres WITH PASSWORD 'postgres';"
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install poetry
         run: pipx install poetry==2.0.0
@@ -64,6 +66,8 @@ jobs:
     needs: tests
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - run: pipx install poetry==2.0.0
 

.github/workflows/documentation.yaml

@@ -15,6 +15,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Deploy docs
         uses: mhausenblas/mkdocs-deploy-gh-pages@master
@@ -29,6 +31,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/pip_install.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5

.github/workflows/poetry_build.yml

@@ -11,8 +11,9 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
 
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: "Set up Python 3.10"
         uses: actions/setup-python@v5

.github/workflows/poetry_update.yml

@@ -17,8 +17,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v3
-      - name: Install poetry
-        run: pipx install poetry==2.0.0
+        with:
+          persist-credentials: false
+      - run: pipx install poetry==2.0.0
+
       - uses: actions/setup-python@v3
         with:
           python-version: "3.10"

.github/workflows/precommit.yml

@@ -12,6 +12,8 @@ jobs:
     timeout-minutes: 3
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.10"

.github/workflows/publish_pypi.yml

@@ -21,8 +21,9 @@ jobs:
         if: ${{ env.CURRENT_PYPI_TOKEN == '' }}
         run: echo "Secret PYPI_TOKEN is not defined." && exit 1
 
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: "Set up Python 3.10"
         uses: actions/setup-python@v5

CHANGELOG.md

@@ -6,6 +6,7 @@
     * Remove `exclude` field, and move `packages` field to `tool.poetry` section, in pyproject.toml (\#771).
 * Testing:
     * Improve configuration for coverage GitHub Action step (\#772).
+    * Add `persist-credentials: false` to all `actions/checkout@v4` GitHub Action steps (\#773).
 
 # 2.6.1