fix: ensure we're not persisting credentials after checkouts (#77)

Signed-off-by: jmeridth <[email protected]>

Author: jmeridth

.github/workflows/actionlint.yaml

@@ -8,6 +8,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Check workflow files
         uses: docker://rhysd/actionlint:latest
         with:

.github/workflows/labeler.yaml

@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/[email protected]
         with:
           configuration-path: ${{ inputs.config-path }}

.github/workflows/major-version-updater.yaml

@@ -21,6 +21,7 @@ jobs:
         with:
           fetch-tags: true
           ref: ${{ inputs.tag-name }}
+          persist-credentials: false
       - name: version
         id: version
         env:

.github/workflows/release-image.yaml

@@ -39,6 +39,8 @@ jobs:
       IMAGE_REGISTRY_PASSWORD: ${{ secrets.image-registry-password }}
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
       - name: Log in to the Container registry