[anish-sujanani]

Set persist-credentials: false on actions/checkout

actions/checkout writes a credential for the GITHUB_TOKEN into .git/config and leaves it
there for the rest of the job. Nothing in this repository is leaking it today — this change removes
the material that a later mistake would expose: an artifact upload whose path includes the
repository root, a debug step that prints git config, a broad Docker build context, or a
dependency's install script reading the workspace.

What changed

1 actions/checkout step across 1 workflow file. One or two
added lines per step; nothing else moves.

• postman.yaml → quality-checks

Why this is safe here

The job(s) changed here perform no git or gh operation against the origin — nothing reads the credential from .git/config — so behaviour is unchanged.

A job only depends on the persisted credential if it runs git push or git tag against the
origin. Where a token is passed explicitly — via env: or as an action input — it is unaffected by
this change, because gh and actions read it from the environment rather than from git's config.

Verification

The edit was checked three ways before raising: the parsed YAML is identical once the added keys
are stripped, the number of added lines matches the number of actions/checkout steps in each
file, and actionlint reports no new issues.

If this breaks something

Say so and I will revert it — a defence-in-depth change is not worth a broken pipeline. If a job
turns out to need the credential, the fix is to authenticate explicitly rather than ambiently
(git push "https://x-access-token:$GH_TOKEN@github.com/$GITHUB_REPOSITORY.git" ...) and I am
happy to make that change instead.

Raised as part of a CI/CD security posture review (control PM_GH_REPO_036).

[anish-sujanani]

Closing — not resolvable, and not worth resolving.

This PR adds persist-credentials: false to .github/workflows/postman.yaml, but that file was deleted on main in d3fbd76 ("feat: build deterministic gateway showcase monorepo"). That makes this a modify/delete conflict, which is why GitHub's web editor won't offer a resolution — it only handles content conflicts in files present on both sides. There is nothing to merge: the fix targets a file that no longer exists.

The underlying PM_GH_REPO_036 finding is still open, though. .github/workflows/quality.yaml is now the only workflow on main and its actions/checkout@v4 has no persist-credentials setting. A replacement PR will be raised against that file.

Note also that #8 reintroduces postman.yaml with actions/checkout@v6 and no persist-credentials setting, so the finding will return there when it merges.