From 9b17ada6d0e369d8ecb804ccd2aab9eb886b39db Mon Sep 17 00:00:00 2001
From: Anish Sujanani <anish.sujanani@postman.com>
Date: Thu, 17 Sep 2026 10:58:03 +0530
Subject: [PATCH] Set persist-credentials: false on actions/checkout

actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting
persist-credentials: false removes it, as defence in depth against a later step
exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036.
---
 .github/workflows/ci.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b177adf..8e9981e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -21,5 +21,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y fakeroot musl-tools
       - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
       - uses: Swatinem/rust-cache@v2
       - run: cargo build $CARGO_ARGS