fix: ensure we're not persisting credentials after checkouts

.github/workflows/ci.yml

@@ -11,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           go-version: "^1.23.4"
@@ -50,6 +52,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           go-version: "^1.23.4"

.github/workflows/lint.yml

@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           go-version: stable

.github/workflows/post-merge.yml

@@ -11,6 +11,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v5.0.0
+        with:
+          persist-credentials: false
       - id: Fetch_tags
         run: git fetch --prune --unshallow --tags
       - run: git describe --tags

.github/workflows/release.yml

@@ -26,6 +26,7 @@ jobs:
         uses: actions/checkout@v5.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Go
         uses: actions/setup-go@v6
         with:

.github/workflows/site.yml

@@ -11,6 +11,7 @@ jobs:
         with:
           submodules: recursive # Fetch Hugo themes (true OR recursive)
           fetch-depth: 0 # Fetch all history for .GitInfo and .Lastmod
+          persist-credentials: false
 
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@v3.0.0