Consider setting persist-credentials: false on read-only checkout steps in changes jobs

[coderabbitai]

Summary

Follow-up from PR #7332, requested by @LesnyRumcajs.

The PR added a preliminary changes job (using dorny/paths-filter) to several lint workflows to work around the fact that merge_group events do not support path filters. Each of these new changes jobs performs an actions/checkout@v7 step that is read-only (only used to evaluate the diff for path filtering), but does not set persist-credentials: false.

zizmor flagged this as a potential "artipacked" credential persistence issue: by default, actions/checkout persists the Git token in the local git config, which could be exposed to subsequent steps/artifacts if not needed.

Affected files

• .github/workflows/actions-lint.yml
• .github/workflows/docker-lint.yml
• .github/workflows/docs-check.yml
• .github/workflows/go-lint.yml
• .github/workflows/link-check.yml
• .github/workflows/lists-lint.yml
• .github/workflows/rubocop.yml
• .github/workflows/shellcheck.yml
• .github/workflows/yaml-lint.yml

Suggested change

For the actions/checkout@v7 step within each changes job, add:

with:
  persist-credentials: false

This was intentionally deferred as out-of-scope for PR #7332, which focuses on the path-filter gating logic itself.

Acceptance criteria

• Decide whether this is worth addressing (low risk, since these are read-only checkouts in public-repo lint jobs) or can be closed as won't-fix.
• If addressed, add persist-credentials: false to the checkout step in each affected changes job across the listed workflow files.

References

• PR: fix(ci): ignore paths in merge queue (lints-only) #7332
• Comment: fix(ci): ignore paths in merge queue (lints-only) #7332 (comment)
• Requested by: @LesnyRumcajs

[Osraka]

I'd like to take this follow-up. I'll limit the change to the nine changes jobs listed here, adding persist-credentials: false only to their read-only checkout steps. I'll leave the existing path-filter logic untouched and verify the workflows with actionlint and zizmor. Does this scope match your intent?

[LesnyRumcajs]

@Osraka Thanks for you interest; this is a security topic so it needs to be investigated internally by the core team.