ci: disable checkout credential persistence

[robjtede]

Disable checkout credential persistence in the workflows to prevent later steps from reusing the checkout token. git diff --check and git show --check HEAD pass.

Summary by CodeRabbit

• Chores
  • Improved continuous integration security by preventing temporary checkout credentials from being persisted during automated checks.
  • Applied this protection consistently across build, linting, formatting, and documentation workflows.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions checkout steps in the CI, clippy, format, and docs jobs now disable persisted credentials on runners.

Changes

Workflow credential handling

Layer / File(s)	Summary
Disable checkout credential persistence .github/workflows/ci.yml, .github/workflows/lint.yml	The checkout steps set persist-credentials: false in the CI, clippy, format, and docs jobs.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main workflow change: disabling checkout credential persistence.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/checkout-persist-credentials

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 33-34: Update both actions/checkout steps in the release workflow
to set persist-credentials to false under their with configuration. Apply the
same setting to each checkout invocation, preserving all existing checkout
options.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1bbbfe88-3690-4d53-a535-8cc2a076ed74

📥 Commits

Reviewing files that changed from the base of the PR and between 8a05daf and 39f1f9a.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/lint.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 4 'actions/checkout|persist-credentials' .github/workflows

Repository: x52dev/inspect-cert-chain

Length of output: 4000

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,110p' .github/workflows/release.yml

Repository: x52dev/inspect-cert-chain

Length of output: 3931

---

Add persist-credentials: false to the release checkout steps.

.github/workflows/release.yml has two actions/checkout steps at lines 23 and 73, and neither sets persist-credentials: false. Add the setting to both checkout steps so release jobs do not retain credentials beyond the checkout action.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 33 - 34, Update both actions/checkout
steps in the release workflow to set persist-credentials to false under their
with configuration. Apply the same setting to each checkout invocation,
preserving all existing checkout options.