From 86248ddf7a49aaf600f04c665df442da27d808e9 Mon Sep 17 00:00:00 2001
From: Yaacov Rydzinski <yaacovCR@gmail.com>
Date: Mon, 2 Mar 2026 16:57:29 +0200
Subject: [PATCH] internal(release): checkout repo  in extra steps

---
 .github/workflows/release.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e6bdc9cd3b..1b8d187e6f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,8 +93,14 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     permissions:
+      contents: read # for actions/checkout
       id-token: write # for npm trusted publishing via OIDC
     steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -124,6 +130,11 @@ jobs:
     permissions:
       contents: write # for creating GitHub release
     steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Download release notes
         uses: actions/download-artifact@v4
         with: