From 1b8436fd69e71a37f9d0b5312397ceede5800c4c Mon Sep 17 00:00:00 2001
From: Anish Sujanani <anish.sujanani@postman.com>
Date: Thu, 17 Sep 2026 11:05:28 +0530
Subject: [PATCH] Set persist-credentials: false on actions/checkout

actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting
persist-credentials: false removes it, as defence in depth against a later step
exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036.
---
 .github/workflows/main.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b54f43f..f1d02a5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,6 +10,8 @@ jobs:
     steps:
     
       - uses: actions/checkout@v1
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v1
         with: