Niels Lohmann c0aa5f0e5a Do not persist git credentials in publish_documentation's checkout ...

The checkout step in publish_documentation.yml left the default
persist-credentials: true, so GITHUB_TOKEN stayed writable in
.git/config for the rest of the job (zizmor's artipacked finding). The
Deploy documentation step authenticates through its own github_token
input to peaceiris/actions-gh-pages and does not push with the
checked-out credentials, so persist-credentials: false is safe here,
matching every other checkout in the workflow set.

Overlaps #5638, which edits this same checkout step (adds
fetch-depth: 0); expect a rebase conflict there.

Part of #5718 item 2

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

2026-09-30 18:00:18 +02:00

..

external_ci

Make std::filesystem::path conversion to/from UTF-8 encoded string explicit (#4631)

2025-04-04 10:59:23 +02:00

ISSUE_TEMPLATE

Update bug report template with FAQ reminder (#5037)

2025-12-21 09:14:44 +01:00

workflows

Do not persist git credentials in publish_documentation's checkout

2026-09-30 18:00:18 +02:00

CODE_OF_CONDUCT.md

Clean up and document project files (#4560)

2025-01-17 06:53:35 +01:00

CODEOWNERS

Update CODEOWNERS (#4126)

2023-08-28 22:04:08 +02:00

config.yml

Overwork project infrastructure (#5218)

2026-06-30 18:09:06 +02:00

CONTRIBUTING.md

Add missing headers to BUILD.bazel and check it in CI (#5554)

2026-09-24 17:07:21 +02:00

dependabot.yml

🔒 fix security findings (#5245)

2026-07-08 16:40:58 +02:00

FUNDING.yml

Clean up and document project files (#4560)

2025-01-17 06:53:35 +01:00

labeler.yml

Add BON8 support (#2998)

2026-09-27 16:56:21 +02:00

PULL_REQUEST_TEMPLATE.md

Check the fuzzers' UBJSON/BJData round-trip invariants in the unit tests (#5569)

2026-09-25 08:29:02 +02:00

SECURITY.md

Document response times, supported versions, access, secrets, and dependency policies (#5580)

2026-09-25 20:34:58 +02:00