ci: release checkouts retain unnecessary Git credentials #1029

Version / branch / commit

main at 1b5db1765672820caac1684b168c9898b5ba3593.

OS and environment

Workflow configuration issue; platform-independent. Reviewed from .github/workflows/release-artifacts.yml and .github/workflows/ci.yml.

Steps to verify

1. Inspect .github/workflows/ci.yml checkout steps around lines 20-26: they explicitly set persist-credentials: false.
2. Inspect the package job's ordinary/requested-ref checkout steps in .github/workflows/release-artifacts.yml around lines 33-43.
3. Inspect the npm publish job checkout around lines 126-133.
4. None of the three release checkout paths sets persist-credentials: false.
5. Search the release workflow for an actual git command that requires checkout's persisted credential. No such command is present. GitHub Release publication instead supplies GH_TOKEN: ${{ github.token }} directly to its publishing step.

actions/checkout therefore retains its authentication configuration for later steps by default. In the package matrix the job has contents: write, so trusted tests and build/package scripts receive avoidable access to that credential.

Expected behavior

Release checkout credentials should not remain available to subsequent build and test steps unless a documented later Git operation requires them. Publication should continue using explicit, step-scoped credentials.

Actual behavior

All release checkout variants retain checkout's default persisted Git credential. This is inconsistent with the repository's CI and action-smoke workflows, which already disable persistence.

No credential exfiltration or malicious current step was found. This is a low-severity workflow defense-in-depth issue, not a demonstrated supply-chain compromise.

Suggested fix and verification

Add:

with:
  persist-credentials: false

to the normal package checkout, requested-ref checkout (alongside ref), and npm-publish checkout. Then run workflow syntax validation and the normal package/release dry-run or native release checks. Preserve existing least-privilege job permissions and explicit GH_TOKEN/OIDC publication paths.

Reported from codebase audit finding SEC-09. PR #951 is related workflow hardening but does not add this checkout setting.