Harden GitHub Actions checkout steps by disabling credential persistence

[coderabbitai]

Summary

Follow up on the security finding raised during review of #828: ensure every GitHub Actions checkout step in this repository explicitly disables credential persistence by setting persist-credentials: false where repository code is executed afterwards.

Why this matters

actions/checkout persists the workflow token in the local git configuration by default. When a job checks out repository code and then runs that code, the checked-out code has an avoidable opportunity to read the token. Setting persist-credentials: false reduces that exposure.

Affected areas identified in the repository scan

• .github/workflows/single-mongo.yml (Line 38)
• .github/workflows/tests-auth.yml (Line 28)
• .github/workflows/tests-oldest.yml (Line 37)

Required changes

• Review every workflow in this repository that uses actions/checkout.
• For each applicable checkout step, add:
  • with:
  • persist-credentials: false
• If any workflow genuinely requires persisted git credentials after checkout, document the reason inline in the workflow and keep the exception as narrow as possible.
• Also review locally defined reusable workflows under .github/workflows/, because callers may inherit the checkout behaviour from those shared job definitions.

Acceptance criteria

• All applicable actions/checkout steps in repository workflows explicitly set persist-credentials: false.
• Any intentional exception is documented in the workflow with a clear justification.
• Existing CI behaviour remains unchanged apart from the credential-handling hardening.

Backlinks

• Raised from PR: Support authentication/URI optipns for Mongo - cloeses #747 #828
• Review comment: Support authentication/URI optipns for Mongo - cloeses #747 #828 (comment)

Requested by @fizyk.

[coderabbitai]

🔗 Related PRs

#751 - Use shared-diagram workflow [merged]
#756 - Install pytest-mongo as editable on CI [merged]
#766 - Improved coverage reliability in CI [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!