From 0478d0b3e4fb5c0e18eefc1e5f74b63c7aa7f4aa Mon Sep 17 00:00:00 2001
From: Anish Sujanani <anish.sujanani@postman.com>
Date: Thu, 17 Sep 2026 11:05:36 +0530
Subject: [PATCH] Set persist-credentials: false on actions/checkout

actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting
persist-credentials: false removes it, as defence in depth against a later step
exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036.
---
 .github/workflows/test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8f3a28682..06f31411e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Get Code
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Use Node JS ${{ matrix.node-version }}
         uses: actions/setup-node@v1
         with: