ci: disable credential persistence in build-validation checkout

[SamErde]

TL;DR

Sets persist-credentials: false on the actions/checkout step in build-validation.yaml. This job only reads the repository and never pushes or fetches with the token after checkout, so persisting the credential in the git config is unnecessary. Low-cost hardening default (zizmor artipacked finding).

Scope

Intentionally limited to build-validation.yaml. The publish workflows are excluded because they use stefanzweifel/git-auto-commit-action to commit website version bumps, which requires the persisted checkout credential.

Follow-up to review feedback on #1899. Minimal 4-line diff (the file's existing mixed line endings are left untouched here; normalization is proposed separately in #1900).

Suggested by CodeRabbit.

Summary by CodeRabbit

• Chores
  • Improved the build validation process to prevent checkout credentials from being retained after repository access, reducing the risk of unintended token persistence.

[Copilot]

Pull request overview

Hardens the CI build-validation workflow by preventing GitHub’s checkout action from persisting the workflow token in the local git config after checkout, aligning with the job’s read-only usage.

Changes:

• Set persist-credentials: false on the actions/checkout step in build-validation.yaml.
• Added inline comments documenting why credential persistence is disabled.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 809f5d81-6032-4ab3-9ef7-4213a5d34634

📥 Commits

Reviewing files that changed from the base of the PR and between 93c2de9 and 5110cc7.

📒 Files selected for processing (1)

• .github/workflows/build-validation.yaml

---

📝 Walkthrough

Walkthrough

The actions/checkout step in the build-validation workflow was updated to add persist-credentials: false, with comments explaining the repository checkout token should not remain in git config.

Changes

Checkout Hardening

Layer / File(s)	Summary
Set persist-credentials false in checkout step .github/workflows/build-validation.yaml	Adds a with block to actions/checkout that sets persist-credentials: false and documents the read-only checkout behavior.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• maester365/maester#1873: Also updates actions/checkout usage to disable persisted credentials in workflow steps.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: disabling persisted checkout credentials in build-validation.
Description check	✅ Passed	The description covers what changed, why, and the limited scope, but omits the template's issue-closing line and checklist details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[merill]

LGTM