From 5bfeca2ff543bb78d203f387b05c8ff8a5725bd8 Mon Sep 17 00:00:00 2001
From: "wave-av-release-bot[bot]"
 <267485050+wave-av-release-bot[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 00:56:08 +0000
Subject: [PATCH] chore(guard): sync vendored public-repo-guard to canonical

---
 .github/workflows/public-repo-guard.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/public-repo-guard.yml b/.github/workflows/public-repo-guard.yml
index 196e36ff..2b29c00c 100644
--- a/.github/workflows/public-repo-guard.yml
+++ b/.github/workflows/public-repo-guard.yml
@@ -43,6 +43,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          # Checkout defaults to persisting the job token for later steps: since v6 it
+          # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in
+          # .git/config itself. It is still a live credential in the job, and this job
+          # downloads a third-party binary (gitleaks, below) and runs it over the whole
+          # tree. Nothing here pushes -- the scan is `--no-git` over the working tree --
+          # so no step needs authenticated Git; drop it. (zizmor: artipacked)
+          persist-credentials: false
 
       # gitleaks' GitHub Action requires a paid license for organizations; the CLI
       # itself is MIT-licensed and free. Pin the version AND verify the release