From 1768c083213d1e7a8bba354253b5f12fb9cb7bea Mon Sep 17 00:00:00 2001
From: correctmost <134317971+correctmost@users.noreply.github.com>
Date: Sun, 23 Aug 2026 12:28:03 -0400
Subject: [PATCH] Don't persist git credentials during testing and linting
 workflows

This commit addresses some low-severity "artipacked" warnings from
zizmor.
---
 .github/workflows/bandit.yaml            | 2 ++
 .github/workflows/flake8.yaml            | 2 ++
 .github/workflows/mypy.yaml              | 2 ++
 .github/workflows/pylint.yaml            | 2 ++
 .github/workflows/pytest.yaml            | 2 ++
 .github/workflows/ruff-format.yaml       | 2 ++
 .github/workflows/ruff-lint.yaml         | 2 ++
 .github/workflows/translation-check.yaml | 2 ++
 8 files changed, 16 insertions(+)

diff --git a/.github/workflows/bandit.yaml b/.github/workflows/bandit.yaml
index 1b71ab6971..10d379516a 100644
--- a/.github/workflows/bandit.yaml
+++ b/.github/workflows/bandit.yaml
@@ -7,6 +7,8 @@ jobs:
             image: archlinux/archlinux:latest
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+              with:
+                persist-credentials: false
             - run: pacman --noconfirm -Syu bandit
             - name: Security checkup with Bandit
               run: bandit -r archinstall || exit 0
diff --git a/.github/workflows/flake8.yaml b/.github/workflows/flake8.yaml
index 80c086a0b0..be366b4896 100644
--- a/.github/workflows/flake8.yaml
+++ b/.github/workflows/flake8.yaml
@@ -7,6 +7,8 @@ jobs:
             image: archlinux/archlinux:latest
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+              with:
+                persist-credentials: false
             - name: Prepare arch
               run: |
                 pacman-key --init
diff --git a/.github/workflows/mypy.yaml b/.github/workflows/mypy.yaml
index aab849cb1f..61dee1227f 100644
--- a/.github/workflows/mypy.yaml
+++ b/.github/workflows/mypy.yaml
@@ -7,6 +7,8 @@ jobs:
             image: archlinux/archlinux:latest
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+              with:
+                persist-credentials: false
             - name: Prepare arch
               run: |
                 pacman-key --init
diff --git a/.github/workflows/pylint.yaml b/.github/workflows/pylint.yaml
index e3480de7fa..c0570b9e88 100644
--- a/.github/workflows/pylint.yaml
+++ b/.github/workflows/pylint.yaml
@@ -7,6 +7,8 @@ jobs:
             image: archlinux/archlinux:latest
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+              with:
+                persist-credentials: false
             - name: Prepare arch
               run: |
                 pacman-key --init
diff --git a/.github/workflows/pytest.yaml b/.github/workflows/pytest.yaml
index 6f914de0fb..04e2031025 100644
--- a/.github/workflows/pytest.yaml
+++ b/.github/workflows/pytest.yaml
@@ -8,6 +8,8 @@ jobs:
             options: --privileged
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+              with:
+                persist-credentials: false
             - name: Prepare arch
               run: |
                 pacman-key --init
diff --git a/.github/workflows/ruff-format.yaml b/.github/workflows/ruff-format.yaml
index 0452776380..456684306e 100644
--- a/.github/workflows/ruff-format.yaml
+++ b/.github/workflows/ruff-format.yaml
@@ -5,5 +5,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89  # v4.1.0
       - run: ruff format --diff
diff --git a/.github/workflows/ruff-lint.yaml b/.github/workflows/ruff-lint.yaml
index 12a7f88d5b..9f64314ac3 100644
--- a/.github/workflows/ruff-lint.yaml
+++ b/.github/workflows/ruff-lint.yaml
@@ -5,4 +5,6 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+              with:
+                persist-credentials: false
             - uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89  # v4.1.0
diff --git a/.github/workflows/translation-check.yaml b/.github/workflows/translation-check.yaml
index 40cce6ee53..2e2ce4d6f0 100644
--- a/.github/workflows/translation-check.yaml
+++ b/.github/workflows/translation-check.yaml
@@ -16,6 +16,8 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+              with:
+                persist-credentials: false
             - name: Install gettext
               run: sudo apt-get update && sudo apt-get install -y gettext
             - name: Run translation checks