From e067c7f8e715538855a1f5960430b37012898cc0 Mon Sep 17 00:00:00 2001
From: Anish Sujanani <anish.sujanani@postman.com>
Date: Mon, 7 Sep 2026 11:59:32 +0530
Subject: [PATCH] Set persist-credentials: false on actions/checkout

actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting persist-credentials: false removes it, as defence in depth against a later step exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036.
---
 .github/workflows/plugin-checks.yml | 12 ++++++++++++
 .github/workflows/release.yml       |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/plugin-checks.yml b/.github/workflows/plugin-checks.yml
index 4014703..b02efbd 100644
--- a/.github/workflows/plugin-checks.yml
+++ b/.github/workflows/plugin-checks.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
@@ -22,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
@@ -32,6 +36,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
@@ -43,6 +49,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
@@ -53,6 +61,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
@@ -63,6 +73,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0e91074..1309b20 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Verify tag matches plugin.json version
         run: |