From 92c9e3cd184b08cc47dce855e8ce954d7b9c97fd Mon Sep 17 00:00:00 2001
From: TheCryptoDonkey <TheCryptoDonkey@users.noreply.github.com>
Date: Sat, 18 Jul 2026 22:18:23 +0100
Subject: [PATCH] ci: set persist-credentials false so the read PAT is not
 overridden

---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 118d6ae..3919583 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,13 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
+      # persist-credentials: false — otherwise checkout injects the workflow
+      # GITHUB_TOKEN as an http.https://github.com/.extraheader that overrides
+      # the FORGESWORN_READ_PAT insteadOf rewrite below, and npm ci 404s on the
+      # private @forgesworn/roost-kit dependency (GITHUB_TOKEN can't see other repos).
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24