fix(ci): avoid persisted credentials for public submodules (#2535)

Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>

.github/workflows/build.yml

@@ -6,6 +6,7 @@ on:
   pull_request:
 permissions:
   contents: read
+  packages: read
   pull-requests: read
   # Required for Sentry to associate commits with releases
   actions: read
@@ -24,6 +25,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2

.github/workflows/coverage.yml

@@ -6,6 +6,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 
 concurrency:
@@ -79,6 +80,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
@@ -110,6 +112,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2

.github/workflows/e2e-reusable.yml

@@ -57,6 +57,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
 
 jobs:
   # Smoke/mega-flow gate for PR/push (full=false). The full-suite path lives in
@@ -76,6 +77,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
 
       - name: Cache pnpm store
@@ -386,6 +388,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
 
       - name: Cache pnpm store
@@ -429,6 +432,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
 
       - name: Install pnpm
@@ -527,6 +531,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
 
       - name: Install pnpm

.github/workflows/e2e.yml

@@ -31,6 +31,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 
 concurrency:

.github/workflows/pr-quality.yml

@@ -5,6 +5,7 @@ on:
     types: [opened, synchronize, reopened, labeled, unlabeled, edited]
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref || github.ref }}

.github/workflows/test-reusable.yml

@@ -34,6 +34,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
 
 jobs:
   i18n-coverage:
@@ -110,6 +111,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
@@ -137,6 +139,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
@@ -169,6 +172,7 @@ jobs:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
           # Required for app/src-tauri/vendor/tauri-cef.
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2

.github/workflows/test.yml

@@ -13,6 +13,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 
 concurrency:

.github/workflows/typecheck.yml

@@ -6,6 +6,7 @@ on:
   pull_request:
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref