From f820a82143ae801e500816dede971e565b3d266b Mon Sep 17 00:00:00 2001
From: cpovirk <cpovirk@google.com>
Date: Thu, 30 Jul 2026 09:26:56 -0700
Subject: [PATCH] Set `persist-credentials: false` on `checkout` actions.

See https://docs.zizmor.sh/audits/#artipacked.

Compare https://github.com/jspecify/jspecify/pull/861

RELNOTES=n/a
PiperOrigin-RevId: 956568861
---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1331272b..462ea416 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,6 +23,8 @@ jobs:
           access_token: ${{ github.token }}
       - name: 'Check out repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
       - name: 'Set up JDK ${{ matrix.java }}'
         uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520
         with: