ci: checkout with persist-credentials: false

Author: paulmillr

.github/workflows/nodejs.yml

@@ -26,6 +26,8 @@ jobs:
           - macOS-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node }}
         uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4
         with:

.github/workflows/publish-npm.yml

@@ -4,12 +4,15 @@ on:
     types: [created]
 jobs:
   build:
+    name: "Publish to NPM"
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
     steps:
       - uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4
         with:
           node-version: 20