Fixed/waived 3 zizmor rules (#46881)

- misfeature — rule enabled, waived only for the 6 Windows shell: cmd
workflows (catches any future misuse elsewhere).
- excessive-permissions and artipacked — fixed and fully enforced
(removed from gate).

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41198


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Improved CI/CD security by disabling credential persistence across
many workflows.
* Tightened workflow permissions to least-privilege for selected build
and analysis jobs.
* Made runner hardening and credential handling explicit in several
deployment and test workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

.github/workflows/build-binaries.yaml

@@ -31,6 +31,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/build-fleetctl-msi.yml

@@ -54,6 +54,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Extract version
         id: extract_version

.github/workflows/build-fleetctl-pkg.yml

@@ -51,6 +51,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Extract version
         id: extract_version

.github/workflows/build-fleetd_tables.yaml

@@ -22,6 +22,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/build-fleetdm-fleetctl-check-vulnerabilities.yml

@@ -37,6 +37,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a

.github/workflows/build-orbit.yaml

@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Import signing keys
         env:

.github/workflows/check-automated-doc.yml

@@ -42,6 +42,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/check-bomutils-vulnerabilities.yml

@@ -37,6 +37,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0

.github/workflows/check-script-diff.yml

@@ -25,6 +25,7 @@ jobs:
             - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
               with:
                 fetch-depth: 0  # Fetch full history so merge base can be found
+                persist-credentials: false
 
             - name: Get Changed Manifest Files # fetch the changed manifest files
               id: changed_files

.github/workflows/check-vulnerabilities-in-released-docker-images.yml

@@ -30,6 +30,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0

.github/workflows/check-wix-vulnerabilities.yml

@@ -37,6 +37,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0

.github/workflows/close-stale-fleetie-initiated-issues.yml

@@ -54,6 +54,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/codeql-analysis.yml

@@ -52,6 +52,8 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
     
     - name: Set up Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/collect-eng-metrics-test.yml

@@ -38,6 +38,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0

.github/workflows/collect-eng-metrics.yml

@@ -29,6 +29,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0

.github/workflows/db-upgrade-test.yml

@@ -32,6 +32,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -41,4 +43,4 @@ jobs:
       - name: Run upgrade test
         run: |
           cd test/upgrade
-          FLEET_VERSION_A=${{ github.event.inputs.from-version }} FLEET_VERSION_B=${{ github.event.inputs.to-version }} go test -v
+          FLEET_VERSION_A=${{ github.event.inputs.from-version }} FLEET_VERSION_B=${{ github.event.inputs.to-version }} go test -v

.github/workflows/dependency-review.yml

@@ -23,6 +23,8 @@ jobs:
 
       - name: 'Checkout Repository'
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          persist-credentials: false
 
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1

.github/workflows/deploy-agent-downloader.yml

@@ -32,6 +32,11 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        # Keep the token persisted: the "git fetch --prune --unshallow" step below fetches from the
+        # GitHub origin, so authenticated access avoids anonymous rate limits and keeps working if
+        # the repository ever becomes private.
+        persist-credentials: true
 
     # Configure our access credentials for the Heroku CLI
     - uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28 # v3.14.15

.github/workflows/deploy-fleet-website.yml

@@ -45,6 +45,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     # Configure our access credentials for the Heroku CLI
     - uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28 # v3.14.15

.github/workflows/deploy-vulnerability-dashboard.yml

@@ -32,6 +32,11 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        # Keep the token persisted: the "git fetch --prune --unshallow" step below fetches from the
+        # GitHub origin, so authenticated access avoids anonymous rate limits and keeps working if
+        # the repository ever becomes private.
+        persist-credentials: true
 
     # Configure our access credentials for the Heroku CLI
     - uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28 # v3.14.15

.github/workflows/docs.yml

@@ -35,6 +35,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Verify Markdown documentation is free of "here" and "click here" link anchors
       run: |

.github/workflows/dogfood-automated-policy-updates.yml

@@ -36,6 +36,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Set up Git
         run: |

.github/workflows/dogfood-deploy.yml

@@ -63,6 +63,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}

.github/workflows/dogfood-gitops.yml

@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout our repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
 
       - name: Checkout GitOps repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -47,6 +49,7 @@ jobs:
           repository: fleetdm/fleet-gitops
           ref: main
           path: fleet-gitops
+          persist-credentials: false
 
       - name: Apply latest configuration to Fleet
         uses: ./fleet-gitops/.github/gitops-action-fleets

.github/workflows/dogfood-signoz-deploy.yml

@@ -38,6 +38,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}

.github/workflows/dogfood-update-testing-qa-apps.yml

@@ -38,6 +38,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Install jq
         run: |

.github/workflows/e2e-agent.yml

@@ -303,6 +303,7 @@ jobs:
         fetch-depth: 1
         sparse-checkout: |
           it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
+        persist-credentials: false
 
     - name: Uninstall Orbit
       run: |
@@ -518,6 +519,7 @@ jobs:
         fetch-depth: 1
         sparse-checkout: |
           it-and-security/lib/windows/scripts/uninstall-fleetd-windows.ps1
+        persist-credentials: false
 
     - name: Uninstall Orbit
       shell: powershell
@@ -566,4 +568,4 @@ jobs:
       if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
       run: gh run cancel ${{ github.run_id }} --repo fleetdm/fleet
       env:
-        GH_TOKEN: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+        GH_TOKEN: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}

.github/workflows/fleet-and-orbit.yml

@@ -77,6 +77,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -239,6 +241,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -282,6 +286,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -350,6 +356,7 @@ jobs:
         with:
           sparse-checkout: it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Download pkg
         id: download

.github/workflows/fleetctl-preview-latest.yml

@@ -64,6 +64,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/fleetd-tuf.yml

@@ -34,6 +34,7 @@ jobs:
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/generate-desktop-targets.yml

@@ -10,9 +10,8 @@ defaults:
     # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
     shell: bash
 
+# Least-privilege default; jobs that build attestations grant id-token/attestations at the job level.
 permissions:
-  id-token: write
-  attestations: write
   contents: read
 
 jobs:
@@ -34,6 +33,10 @@ jobs:
     # later, avoiding runtime errors on systems using macOS 14 or newer.
     runs-on: macos-14
     needs: set-version
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -42,6 +45,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -113,6 +118,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -161,6 +168,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -202,6 +211,10 @@ jobs:
   desktop-linux:
     needs: set-version
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -210,6 +223,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -238,6 +253,10 @@ jobs:
   desktop-linux-arm64:
     needs: set-version
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -246,6 +265,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/generate-nudge-targets.yml

@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Generate nudge.app.tar.gz
         run: make nudge-app-tar-gz version=$NUDGE_VERSION out-path=.

.github/workflows/generate-osqueryd-targets.yml

@@ -26,13 +26,17 @@ defaults:
 env:
   OSQUERY_VERSION: 5.23.0
 
+# Least-privilege default; each build job grants id-token/attestations at the job level.
 permissions:
-  id-token: write
-  attestations: write
+  contents: read
 
 jobs:
   generate-macos:
     runs-on: macos-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -41,6 +45,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Generate osqueryd.app.tar.gz
         run: |
@@ -70,6 +76,10 @@ jobs:
 
   generate-linux:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -78,6 +88,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Download and extract osqueryd for linux
         run: |
@@ -101,6 +113,10 @@ jobs:
 
   generate-linux-arm64:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -109,6 +125,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install file
         run: |
@@ -136,6 +154,10 @@ jobs:
 
   generate-windows:
     runs-on: windows-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -144,6 +166,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Download osquery msi for Windows
         run: |
@@ -169,6 +193,10 @@ jobs:
 
   generate-windows-arm64:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -177,6 +205,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Download osquery msi for Windows
         run: |

.github/workflows/generate-swift-dialog-targets.yml

@@ -42,6 +42,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Generate swiftDialog.app.tar.gz
         run: make swift-dialog-app-tar-gz version=${SWIFT_DIALOG_VERSION} build=${SWIFT_DIALOG_BUILD} out-path=.

.github/workflows/golangci-lint.yml

@@ -60,6 +60,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -123,6 +125,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0  # Fetch full history for accurate diff
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/goreleaser-fleet.yaml

@@ -40,6 +40,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0 # Needed for goreleaser
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
@@ -235,6 +236,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Download signed fleetctl binary
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
@@ -298,6 +300,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Download unsigned fleetctl binary
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6

.github/workflows/goreleaser-orbit.yaml

@@ -29,6 +29,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
@@ -94,6 +96,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
@@ -141,6 +145,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
@@ -185,6 +191,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
@@ -241,6 +249,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our

.github/workflows/goreleaser-snapshot-fleet.yaml

@@ -49,6 +49,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0

.github/workflows/incubate-website-deps.yml

@@ -30,6 +30,7 @@ jobs:
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0  # full history needed to compute commit timestamp
+          persist-credentials: false
 
       - name: Verify 72-hour incubation
         if: github.event_name == 'pull_request'

.github/workflows/ingest-maintained-apps.yml

@@ -39,6 +39,7 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.head_ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/loadtest-infra.yml

@@ -95,6 +95,8 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}

.github/workflows/loadtest-osquery-perf.yml

@@ -84,6 +84,8 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}

.github/workflows/loadtest-shared.yml

@@ -43,6 +43,8 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}

.github/workflows/pr-helm.yaml

@@ -35,6 +35,8 @@ jobs:
 
     - name: checkout
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
     - name: create temp dir
       run: mkdir -p helm-temp
     - name: helm dependency build

.github/workflows/product-eng-handbook-summary.yml

@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Collect handbook diffs
         id: diffs

.github/workflows/publish-go-module.yml

@@ -29,6 +29,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -39,4 +41,4 @@ jobs:
 
       - name: Publish go module
         run: |
-          GOPROXY=proxy.golang.org go list -m github.com/fleetdm/fleet/v4@${{ github.ref_name }}
+          GOPROXY=proxy.golang.org go list -m github.com/fleetdm/fleet/v4@${{ github.ref_name }}

.github/workflows/randokiller-go.yml

@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Parse Config
         id: get_config_json
@@ -65,6 +67,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/release-fleetctl-docker-deps.yaml

@@ -38,6 +38,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/release-fleetd-base.yml

@@ -63,6 +63,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -148,6 +149,7 @@ jobs:
             .github/actions/r2-upload/action.yml
             .github/scripts/rclone-install.sh
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Install fleetctl
         run: npm install -g fleetctl
@@ -292,6 +294,7 @@ jobs:
             .github/actions/r2-upload/action.yml
             .github/scripts/rclone-install.sh
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Download signed artifact
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
@@ -331,6 +334,7 @@ jobs:
             .github/actions/r2-upload/action.yml
             .github/scripts/rclone-install.sh
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Download latest-tuf-meta.json artifact
         uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4

.github/workflows/release-fleetd-chrome-beta.yml

@@ -45,6 +45,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Run test
         working-directory: ./ee/fleetd-chrome

.github/workflows/release-fleetd-chrome.yml

@@ -46,6 +46,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Run test
         working-directory: ./ee/fleetd-chrome

.github/workflows/release-helm.yaml

@@ -30,6 +30,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
     - uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260
       with:
         token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/scorecards-analysis.yml

@@ -10,8 +10,9 @@ on:
   push:
     branches: [ "main" ]
 
-# Declare default permissions as read only.
-permissions: read-all
+# Declare least-privilege default permissions; the analysis job grants what it needs at the job level.
+permissions:
+  contents: read
 
 jobs:
   gradle-wrapper-validation:
@@ -36,6 +37,8 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
+      # Needed to check out the repository (explicit, for clarity)
+      contents: read
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
       # Needed to publish results and get a badge (see publish_results below).

.github/workflows/secrets-to-confidential.yml

@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
   cancel-in-progress: true
 
+# The sync uses a dedicated PAT (SECRETS_GITHUB_PAT), so the default GITHUB_TOKEN needs no permissions.
+permissions: {}
+
 jobs:
   sync_secrets:
     runs-on: ubuntu-latest

.github/workflows/sync-maintained-apps-outputs.yml

@@ -51,6 +51,8 @@ jobs:
 
       - name: Checkout Repository
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Verify Source Directory Exists
         run: |

.github/workflows/test-android.yml

@@ -43,6 +43,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -151,6 +153,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -253,6 +257,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -363,6 +369,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Download coverage artifacts
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

.github/workflows/test-db-changes.yml

@@ -39,6 +39,7 @@ jobs:
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     # TODO: This doesn't cover all scenarios since other PRs might
     # be merged into `main` after this check has passed.

.github/workflows/test-fleet-agent-downloader-changes.yml

@@ -33,6 +33,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     # Set the Node.js version
     - name: Use Node.js ${{ matrix.node-version }}

.github/workflows/test-fleet-mcp.yml

@@ -38,6 +38,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-fleet-slackbot.yml

@@ -41,6 +41,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1

.github/workflows/test-fleetd-chrome.yml

@@ -42,6 +42,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: JS Dependency Cache
         id: js-cache

.github/workflows/test-fma-darwin-pr-only.yml

@@ -45,6 +45,7 @@ jobs:
           fetch-depth: 0 # Need full history to compare with base branch
           ref: ${{ github.ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-fma-darwin.yml

@@ -41,6 +41,7 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-fma-windows-pr-only.yml

@@ -45,6 +45,7 @@ jobs:
           fetch-depth: 0 # Need full history to compare with base branch
           ref: ${{ github.ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-fma-windows.yml

@@ -41,6 +41,7 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-go-activity.yaml

@@ -96,6 +96,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
       - name: Download artifacts
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:

.github/workflows/test-go-suite.yaml

@@ -116,6 +116,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-go-windows.yml

@@ -46,6 +46,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-go.yaml

@@ -132,6 +132,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -234,6 +236,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
       - name: Download artifacts
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:

.github/workflows/test-js.yml

@@ -44,6 +44,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
@@ -89,6 +91,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1

.github/workflows/test-mock-changes.yml

@@ -38,6 +38,7 @@ jobs:
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-native-tooling-packaging.yml

@@ -50,6 +50,8 @@ jobs:
     - name: Checkout Code
       if: ${{ matrix.build_type ==  'local' }}
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Install Go
       if: ${{ matrix.build_type ==  'local' }}

.github/workflows/test-packaging-build-docker-deps.yml

@@ -51,6 +51,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-packaging.yml

@@ -78,6 +78,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/test-puppet.yml

@@ -40,6 +40,7 @@ jobs:
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Install Ruby Gems
       working-directory: ./ee/tools/puppet/fleetdm/

.github/workflows/test-stale-fleetie-issue-scripts.yml

@@ -54,6 +54,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/test-vulnerability-dashboard-changes.yml

@@ -33,6 +33,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     # Set the Node.js version
     - name: Use Node.js ${{ matrix.node-version }}

.github/workflows/test-website.yml

@@ -43,6 +43,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Set the Node.js version
       - name: Use Node.js ${{ matrix.node-version }}

.github/workflows/test-yml-specs.yml

@@ -43,6 +43,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

.github/workflows/tfvalidate.yml

@@ -37,6 +37,8 @@ jobs:
 
       - name: Clone repo
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install terraform
         uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2.0.3

.github/workflows/trivy-scan.yml

@@ -103,6 +103,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ matrix.branch || github.ref }}
+          persist-credentials: false
 
       - name: Capture checked-out commit SHA
         id: sha

.github/workflows/update-certs.yml

@@ -32,6 +32,8 @@ jobs:
 
     - name: Checkout code
       uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v.24.0
+      with:
+        persist-credentials: false
 
     # We trust own version of mk-ca-bundle.pl and its output, but as an extra check
     # we compare with the cacert.pem served by https://curl.se/ca/cacert.pem (this

.github/workflows/update-osquery-versions.yml

@@ -21,6 +21,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
         with:

.github/workflows/validate-maintained-apps-inputs.yml

@@ -30,6 +30,7 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.head_ref }}
           path: fleet
+          persist-credentials: false
 
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: