ci: do not persist Git credentials

Author: indygreg

.github/workflows/anaconda.yml

@@ -29,6 +29,8 @@ jobs:
           python-version: ${{ matrix.py }}
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Create Anaconda Environment
         run: |
@@ -77,6 +79,8 @@ jobs:
           python-version: ${{ matrix.py }}
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Create Anaconda Environment
         run: |

.github/workflows/external-zstd.yml

@@ -23,6 +23,8 @@ jobs:
           python-version: '3.9'
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Build
         env:
@@ -50,6 +52,8 @@ jobs:
           python -m pip install cffi
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Build
         env:

.github/workflows/pypy.yml

@@ -40,6 +40,8 @@ jobs:
           architecture: ${{ matrix.arch }}
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Build
         run: |
@@ -85,6 +87,8 @@ jobs:
           architecture: ${{ matrix.arch }}
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Dependencies
         run: |

.github/workflows/ruff.yml

@@ -8,4 +8,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: astral-sh/ruff-action@v1

.github/workflows/sdist.yml

@@ -13,6 +13,8 @@ jobs:
           python-version: '3.9'
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Build sdist
         run: |

.github/workflows/sphinx.yml

@@ -8,6 +8,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v6
         with:

.github/workflows/test.yml

@@ -84,6 +84,8 @@ jobs:
           toolchain: stable
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Dependencies
         shell: bash

.github/workflows/typing.yml

@@ -18,6 +18,8 @@ jobs:
     runs-on: 'ubuntu-24.04'
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v6
         with:

.github/workflows/wheel.yml

@@ -37,6 +37,8 @@ jobs:
     runs-on: ${{ endsWith(matrix.image, 'aarch64') && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU
         if: ${{ endsWith(matrix.image, 'ppc64le') || endsWith(matrix.image, 's390x') }}
@@ -79,6 +81,8 @@ jobs:
           python-version: '3.13'
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Dependencies
         run: |
@@ -127,6 +131,8 @@ jobs:
           architecture: ${{ matrix.arch }}
 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Build Wheel
         run: |