From 01844f3fdb3b0220b7a667a8cfe4992945303f20 Mon Sep 17 00:00:00 2001
From: cpovirk <cpovirk@google.com>
Date: Thu, 30 Jul 2026 09:26:56 -0700
Subject: [PATCH] Set `persist-credentials: false` on `checkout` actions.

See https://docs.zizmor.sh/audits/#artipacked.

Compare https://github.com/jspecify/jspecify/pull/861

RELNOTES=n/a
PiperOrigin-RevId: 956568861
---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b85e025..04234824 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - name: 'Set up JDK ${{ matrix.java }}'
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95
         with: