Set persist-credentials to false in GitHub workflows

.github/workflows/api.yaml

@@ -48,6 +48,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/bioblend.yaml

@@ -39,11 +39,13 @@ jobs:
         with:
           fetch-depth: 1
           path: galaxy
+          persist-credentials: false
       - name: Checkout Bioblend
         uses: actions/checkout@v4
         with:
           repository: galaxyproject/bioblend
           path: bioblend
+          persist-credentials: false
       - name: Cache pip dir
         uses: actions/cache@v4
         with:

.github/workflows/build_client.yaml

@@ -14,6 +14,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/build_container_image.yaml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       # https://stackoverflow.com/questions/59810838/how-to-get-the-short-sha-for-the-github-workflow
       - name: Set outputs
         id: commit
@@ -75,6 +77,8 @@ jobs:
     if: github.repository_owner == 'galaxyproject'
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       # https://stackoverflow.com/questions/59810838/how-to-get-the-short-sha-for-the-github-workflow
       - name: Set outputs
         id: commit

.github/workflows/check_test_class_names.yaml

@@ -17,6 +17,8 @@ jobs:
         python-version: ['3.8']
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/codeql-analysis.yml

@@ -41,6 +41,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/converter_tests.yaml

@@ -31,6 +31,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
@@ -41,6 +42,7 @@ jobs:
         with:
           repository: galaxyproject/galaxy-test-data
           path: galaxy-test-data
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/cwl_conformance.yaml

@@ -40,6 +40,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/db_indexes.yaml

@@ -42,6 +42,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/dependencies.yaml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       # Install Python 3.8 for update_lint_requirements.sh
       # Install Python 3.9 (as default) to allow `uv lock` to generate metadata for rucio-clients
       - uses: actions/setup-python@v5

.github/workflows/deployment.yaml

@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/docs.yaml

@@ -29,6 +29,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/first_startup.yaml

@@ -31,6 +31,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/framework_tools.yaml

@@ -43,6 +43,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/framework_workflows.yaml

@@ -44,6 +44,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/integration.yaml

@@ -68,6 +68,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/integration_selenium.yaml

@@ -51,6 +51,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/jest.yaml

@@ -19,6 +19,8 @@ jobs:
         node: [18]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup node
         uses: actions/setup-node@v4
         with:

.github/workflows/js_lint.yaml

@@ -19,6 +19,8 @@ jobs:
         node: [18]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup node
         uses: actions/setup-node@v4
         with:

.github/workflows/lint.yaml

@@ -29,6 +29,8 @@ jobs:
       CORE_PATH: 'lib/galaxy/dependencies/pinned-requirements.txt'
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/lint_openapi_schema.yml

@@ -25,6 +25,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/mulled.yaml

@@ -25,6 +25,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/osx_startup.yaml

@@ -29,6 +29,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/performance.yaml

@@ -42,6 +42,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/pr-title-update.yml

@@ -13,6 +13,8 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Update PR title
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/publish_artifacts.yaml

@@ -15,6 +15,8 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install script dependencies
         run: pip install galaxy-release-util
       - name: Build and publish

.github/workflows/reports_startup.yaml

@@ -26,6 +26,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/selenium.yaml

@@ -51,6 +51,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/test_galaxy_packages.yaml

@@ -23,6 +23,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/test_galaxy_packages_for_pulsar.yaml

@@ -25,6 +25,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}

.github/workflows/test_galaxy_release.yaml

@@ -25,5 +25,6 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Run tests
         run: ./test/release.sh

.github/workflows/toolshed.yaml

@@ -37,6 +37,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/unit-postgres.yaml

@@ -36,6 +36,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'

.github/workflows/unit.yaml

@@ -25,6 +25,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'