ci: release checkouts retain unnecessary Git credentials

[PierrunoYT]

Version / branch / commit

main at 1b5db1765672820caac1684b168c9898b5ba3593.

OS and environment

Workflow configuration issue; platform-independent. Reviewed from .github/workflows/release-artifacts.yml and .github/workflows/ci.yml.

Steps to verify

1. Inspect .github/workflows/ci.yml checkout steps around lines 20-26: they explicitly set persist-credentials: false.
2. Inspect the package job's ordinary/requested-ref checkout steps in .github/workflows/release-artifacts.yml around lines 33-43.
3. Inspect the npm publish job checkout around lines 126-133.
4. None of the three release checkout paths sets persist-credentials: false.
5. Search the release workflow for an actual git command that requires checkout's persisted credential. No such command is present. GitHub Release publication instead supplies GH_TOKEN: ${{ github.token }} directly to its publishing step.

actions/checkout therefore retains its authentication configuration for later steps by default. In the package matrix the job has contents: write, so trusted tests and build/package scripts receive avoidable access to that credential.

Expected behavior

Release checkout credentials should not remain available to subsequent build and test steps unless a documented later Git operation requires them. Publication should continue using explicit, step-scoped credentials.

Actual behavior

All release checkout variants retain checkout's default persisted Git credential. This is inconsistent with the repository's CI and action-smoke workflows, which already disable persistence.

No credential exfiltration or malicious current step was found. This is a low-severity workflow defense-in-depth issue, not a demonstrated supply-chain compromise.

Suggested fix and verification

Add:

with:
  persist-credentials: false

to the normal package checkout, requested-ref checkout (alongside ref), and npm-publish checkout. Then run workflow syntax validation and the normal package/release dry-run or native release checks. Preserve existing least-privilege job permissions and explicit GH_TOKEN/OIDC publication paths.

Reported from codebase audit finding SEC-09. PR #951 is related workflow hardening but does not add this checkout setting.

[Vasanthdev2004]

Confirmed: the three checkouts in release-artifacts.yml leave persist-credentials at its default, so the workflow token stays in the checkout's git config for every later step, including the build and publish steps that do not need it. ci.yml and zero-action-smoke.yml already turn it off on every checkout; pr-auto-review.yml has the same gap on its single checkout, so take that one in the same change. Approving; persist-credentials: false on each, unless a step there pushes, which I do not see.