ci: disable persisted credentials in checkout steps

[tkislan]

Closes #444

Summary

Sets persist-credentials: false on every actions/checkout step in cd.yml, ci.yml and deps.yml, so the GitHub token is not written into the local Git config while repository-controlled npm commands (npm ci, npm install, npm run package, npx better-npm-audit, …) run in those jobs.

Follow-up to the review comment on #422 (discussion_r3613084710).

Changes

Workflow	Checkout steps updated
.github/workflows/cd.yml	1 (package)
.github/workflows/ci.yml	9 (lint, typecheck, qlty, build, check_licenses, spell-check, package-lock-drift-check, audit-prod, audit-all)
.github/workflows/deps.yml	2 (audit, check-deps)
.github/workflows/e2e.yml	0 — already set, left untouched

Why this is safe

Every affected job is read-only — none pushes, tags, or otherwise consumes the persisted credentials, and each workflow's permissions: block is already contents: read. Two jobs touch git and were checked specifically:

• qlty keeps its fetch-depth: 0. persist-credentials: false only strips the auth header after the fetch completes, so full history is still cloned.
• package-lock-drift-check runs git diff --exit-code HEAD, a purely local operation that needs no credentials.

Verification

• All 13 checkout steps across the 4 workflows parse and resolve to persist-credentials: false (12 changed here + 1 pre-existing in e2e.yml).
• prettier --check '.github/**/*.yml' passes — .github/**/*.yml is covered by npm run format in CI.
• Diff is additive only: 23 insertions, 0 deletions, no other checkout inputs altered.

Acceptance criteria

• Every actions/checkout step in the affected workflows sets persist-credentials: false.
• No checkout behavior unrelated to credential persistence is changed.
• The existing secure configuration in .github/workflows/e2e.yml remains unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01129DHTrr8BrrnBCaiLVzYv

Summary by CodeRabbit

• Security
  • Improved workflow security by preventing checkout steps from persisting GitHub credentials across build, validation, packaging, dependency checks, and auditing tasks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 471c5d39-f8b9-4a89-8577-c3c7eb6a7ed8

📥 Commits

Reviewing files that changed from the base of the PR and between c677909 and d2b5023.

📒 Files selected for processing (3)

• .github/workflows/cd.yml
• .github/workflows/ci.yml
• .github/workflows/deps.yml

🚧 Files skipped from review as they are similar to previous changes (3)

• .github/workflows/deps.yml
• .github/workflows/cd.yml
• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The CI, dependency, and package workflows update every affected actions/checkout step to set persist-credentials: false. No other checkout behavior is changed.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Updates Docs	⚠️ Warning	No documentation files were changed here; the PR only edits workflow YAML, and I can't verify the other repos.	Update the relevant docs in deepnote/deepnote and the landing-page roadmap in deepnote/deepnote-internal, or confirm those changes exist there.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: disabling persisted checkout credentials.
Linked Issues check	✅ Passed	All affected checkout steps in cd, ci, and deps set persist-credentials: false, and e2e stays unchanged.
Out of Scope Changes check	✅ Passed	The PR only changes checkout credential persistence in the targeted workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/cd.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/ci.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/deps.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0%. Comparing base (ba5b70b) to head (c677909).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@     Coverage Diff     @@
##   main   #445   +/-   ##
===========================
===========================

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[m1so]

LGTM ✅

(although there are now merge conflicts)