Chore: don't persist creds when checking out in actions (#104778)

* don't persist creds when checking out in actions

* kick CI

* kick CI

* actually commit the merge...

* don't need

* don't need

.github/workflows/frontend-lint.yml

@@ -47,6 +47,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/setup-node@v4
       with:
         node-version-file: '.nvmrc'
@@ -65,6 +67,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/setup-node@v4
       with:
         node-version-file: '.nvmrc'
@@ -88,6 +92,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/setup-node@v4
       with:
         node-version-file: '.nvmrc'
@@ -105,6 +111,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/setup-node@v4
       with:
         node-version-file: '.nvmrc'
@@ -124,6 +132,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/setup-node@v4
       with:
         node-version-file: '.nvmrc'

.github/workflows/issue-opened.yml

@@ -89,6 +89,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@v4 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Send issue to the auto triager action
         id: auto_triage

.github/workflows/pr-e2e-tests.yml

@@ -26,6 +26,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: ./grafana
+          persist-credentials: false
       - run: echo "GRAFANA_GO_VERSION=$(grep "go 1." grafana/go.work |  cut -d\  -f2)" >> "$GITHUB_ENV"
       - uses: dagger/dagger-for-github@e47aba410ef9bb9ed81a4d2a97df31061e5e842e
         with:

.github/workflows/pr-frontend-unit-tests.yml

@@ -52,6 +52,8 @@ jobs:
         chunk: [1, 2, 3, 4, 5, 6, 7, 8]
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/setup-node@v4
       with:
         node-version-file: '.nvmrc'

.github/workflows/pr-test-integration.yml

@@ -48,6 +48,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
@@ -73,6 +75,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup Go
         uses: actions/setup-go@v5
         with:

.github/workflows/publish-kinds-release.yml

@@ -50,6 +50,7 @@ jobs:
         with:
           repository: "grafana/grafana-github-actions"
           path: "./actions"
+          persist-credentials: false
 
       - name: "Install Actions from library"
         run: "npm install --production --prefix ./actions"

.github/workflows/publish-technical-documentation-next.yml

@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: grafana/writers-toolkit/publish-technical-documentation@publish-technical-documentation/v1 # zizmor: ignore[unpinned-uses]
         with:
           website_directory: content/docs/grafana/next

.github/workflows/run-dashboard-search-e2e.yml

@@ -2,7 +2,7 @@ name: run-dashboard-search-e2e
 
 on:
   workflow_run:
-    workflows: 
+    workflows:
       - trigger-dashboard-search-e2e
     types:
       - completed
@@ -95,6 +95,8 @@ jobs:
       steps:
         - name: Checkout repository
           uses: actions/checkout@v4
+          with:
+            persist-credentials: false
         - name: Restore Cached Node Modules
           uses: actions/cache@v3
           with: