set persist credentials to false

[mikofski]

Thoughts? opinions? should we even care?

pvlib-python/.github/workflows/publish.yml

Line 18 in 0c6ab77

- uses: actions/checkout@v4

I have read opposite opinions:

• these discussions are in favor of setting to false so that credentials are not leaked to other steps before cleanup
  • Remove persist-credentials or change the default to false actions/checkout#485 -
  • Yossarian TIL: actions/checkout can leak GitHub credentials
• gh-actions checkout v4

  The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set persist-credentials: false to opt-out.

[markcampanelli]

The action's README makes it seem like this was alleviated in v6. Latest appears to be v7.

[mikofski]

yes indeed! thx!

[markcampanelli]

Nice catch. This actually affects one of my repo's too, so double thanks!