From 77a569694681dffa0ea48823b85c9439897b5a48 Mon Sep 17 00:00:00 2001
From: Frank Elsinga <frank@elsinga.de>
Date: Fri, 19 Sep 2025 23:03:48 +0200
Subject: [PATCH] chore(security): remove unnessesarily persisted permissions
 (#3820)

---
 .github/workflows/android-ci.yml                     | 4 ++++
 .github/workflows/android-device-test.yml            | 2 ++
 .github/workflows/android-testapp-release.yml        | 3 +++
 .github/workflows/cache-cleanup.yml                  | 2 ++
 .github/workflows/gh-pages-android-api.yml           | 2 ++
 .github/workflows/ios-ci.yml                         | 2 ++
 .github/workflows/ios-device-test.yml                | 2 ++
 .github/workflows/ios-release-cocoapods.yml          | 2 ++
 .github/workflows/linux-ci.yml                       | 3 +++
 .github/workflows/macos-ci.yml                       | 1 +
 .github/workflows/node-ci.yml                        | 1 +
 .github/workflows/node-release.yml                   | 5 +++++
 .github/workflows/pr-bloaty-ios.yml                  | 3 +++
 .github/workflows/pr-linux-tests.yml                 | 4 ++++
 .github/workflows/qt-ci.yml                          | 1 +
 .github/workflows/rust-ci.yaml                       | 4 ++++
 .github/workflows/typecheck-scripts.yml              | 2 ++
 .github/workflows/upload-coverage.yml                | 3 +++
 .github/workflows/windows-ci.yml                     | 4 ++++
 vendor/maplibre-native-base/.github/workflows/ci.yml | 2 ++
 20 files changed, 52 insertions(+)

diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml
index 116019100..8dfd11dd9 100644
--- a/.github/workflows/android-ci.yml
+++ b/.github/workflows/android-ci.yml
@@ -29,6 +29,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Get all Android files that have changed
         if: github.event_name != 'workflow_dispatch'
@@ -59,6 +60,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-android-ci
 
@@ -224,6 +226,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-android-ci
 
@@ -281,6 +284,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-android-ci
 
diff --git a/.github/workflows/android-device-test.yml b/.github/workflows/android-device-test.yml
index bd397c48e..c94963004 100644
--- a/.github/workflows/android-device-test.yml
+++ b/.github/workflows/android-device-test.yml
@@ -79,6 +79,8 @@ jobs:
     if: github.repository_owner == 'maplibre' && github.event.workflow_run.conclusion == 'success'
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
         with:
diff --git a/.github/workflows/android-testapp-release.yml b/.github/workflows/android-testapp-release.yml
index bd7a623fd..62b04c277 100644
--- a/.github/workflows/android-testapp-release.yml
+++ b/.github/workflows/android-testapp-release.yml
@@ -11,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - name: Create Release
         run: |
@@ -44,6 +46,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-android-ci
 
diff --git a/.github/workflows/cache-cleanup.yml b/.github/workflows/cache-cleanup.yml
index c164713c3..bc29193d5 100644
--- a/.github/workflows/cache-cleanup.yml
+++ b/.github/workflows/cache-cleanup.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - name: Cleanup
         run: |
diff --git a/.github/workflows/gh-pages-android-api.yml b/.github/workflows/gh-pages-android-api.yml
index 843d88bd3..5f2a961a0 100644
--- a/.github/workflows/gh-pages-android-api.yml
+++ b/.github/workflows/gh-pages-android-api.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Checkout 🛎️
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v4
         with:
diff --git a/.github/workflows/ios-ci.yml b/.github/workflows/ios-ci.yml
index 17b2e871d..b3a4b66f9 100644
--- a/.github/workflows/ios-ci.yml
+++ b/.github/workflows/ios-ci.yml
@@ -41,6 +41,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Get all iOS files that have changed
         if: github.event_name != 'workflow_dispatch'
@@ -75,6 +76,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Cache Bazel
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
diff --git a/.github/workflows/ios-device-test.yml b/.github/workflows/ios-device-test.yml
index 58bd42b3f..0fef5e775 100644
--- a/.github/workflows/ios-device-test.yml
+++ b/.github/workflows/ios-device-test.yml
@@ -22,6 +22,8 @@ jobs:
     if: github.repository_owner == 'maplibre' && github.event.workflow_run.conclusion == 'success'
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - name: Generate token
         uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
diff --git a/.github/workflows/ios-release-cocoapods.yml b/.github/workflows/ios-release-cocoapods.yml
index 277831f2a..23ec606fc 100644
--- a/.github/workflows/ios-release-cocoapods.yml
+++ b/.github/workflows/ios-release-cocoapods.yml
@@ -15,6 +15,8 @@ jobs:
     runs-on: macos-14
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - name: Release (CocoaPods)
         shell: bash -leo pipefail {0}  # so pod is found
diff --git a/.github/workflows/linux-ci.yml b/.github/workflows/linux-ci.yml
index 0d4d6955f..30694c1c7 100644
--- a/.github/workflows/linux-ci.yml
+++ b/.github/workflows/linux-ci.yml
@@ -36,6 +36,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Get all Linux files that have changed
         if: github.event_name != 'workflow_dispatch'
@@ -68,6 +69,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
@@ -222,6 +224,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Install dependencies
         run: .github/scripts/install-linux-deps
diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index b2ebbbf7b..c21f47455 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -60,6 +60,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Cache Bazel
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index 19d978257..8e2c8280c 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -101,6 +101,7 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Get OS Architecture
         if: runner.os == 'MacOS' || runner.os == 'Linux'
diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml
index 554f3a27d..c92243a43 100644
--- a/.github/workflows/node-release.yml
+++ b/.github/workflows/node-release.yml
@@ -14,6 +14,8 @@ jobs:
         shell: bash
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - name: Use Node.js from nvmrc
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
@@ -66,6 +68,7 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Get OS Architecture
         if: runner.os == 'MacOS' || runner.os == 'Linux'
@@ -247,6 +250,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - name: Use Node.js from nvmrc
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
diff --git a/.github/workflows/pr-bloaty-ios.yml b/.github/workflows/pr-bloaty-ios.yml
index 54528e16d..c1cda0ddb 100644
--- a/.github/workflows/pr-bloaty-ios.yml
+++ b/.github/workflows/pr-bloaty-ios.yml
@@ -24,6 +24,7 @@ jobs:
           sparse-checkout: |
             .github
             .nvmrc
+          persist-credentials: false
 
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
         with:
@@ -45,6 +46,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - name: Cache Bloaty
         id: cache-bloaty
diff --git a/.github/workflows/pr-linux-tests.yml b/.github/workflows/pr-linux-tests.yml
index 7a45009bd..f754dd4e4 100644
--- a/.github/workflows/pr-linux-tests.yml
+++ b/.github/workflows/pr-linux-tests.yml
@@ -27,6 +27,7 @@ jobs:
           sparse-checkout: |
             .github
             .nvmrc
+          persist-credentials: false
 
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
         with:
@@ -48,6 +49,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/get-pr-number
         id: get-pr-number
@@ -139,6 +142,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: true
+          persist-credentials: false
 
       - uses: ./.github/actions/get-pr-number
         id: get-pr-number
diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml
index 18582baf6..f689fa2a7 100644
--- a/.github/workflows/qt-ci.yml
+++ b/.github/workflows/qt-ci.yml
@@ -106,6 +106,7 @@ jobs:
         with:
           path: source
           submodules: recursive
+          persist-credentials: false
 
       - name: Install test dependencies
         if: runner.os == 'Linux'
diff --git a/.github/workflows/rust-ci.yaml b/.github/workflows/rust-ci.yaml
index 42da05534..3adfadeaf 100644
--- a/.github/workflows/rust-ci.yaml
+++ b/.github/workflows/rust-ci.yaml
@@ -27,6 +27,8 @@ jobs:
       - uses: taiki-e/install-action@e5f8d33e7166e0491b2ab4ff0567cc6cd6772737 # v2.61.7
         with: { tool: just }
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
       - run: just -v ci-test
 
   msrv:
@@ -36,6 +38,8 @@ jobs:
       - uses: taiki-e/install-action@e5f8d33e7166e0491b2ab4ff0567cc6cd6772737 # v2.61.7
         with: { tool: just }
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
       - name: Read crate metadata
         id: metadata
         run: echo "rust-version=$(sed -ne 's/rust-version *= *\"\(.*\)\"/\1/p' Cargo.toml)" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/typecheck-scripts.yml b/.github/workflows/typecheck-scripts.yml
index f7dee1887..038580f3f 100644
--- a/.github/workflows/typecheck-scripts.yml
+++ b/.github/workflows/typecheck-scripts.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - run: |
           npm install
diff --git a/.github/workflows/upload-coverage.yml b/.github/workflows/upload-coverage.yml
index 95cbb08b0..c671909f2 100644
--- a/.github/workflows/upload-coverage.yml
+++ b/.github/workflows/upload-coverage.yml
@@ -17,6 +17,7 @@ jobs:
           sparse-checkout: |
             .github
             .nvmrc
+          persist-credentials: false
 
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
         with:
@@ -38,6 +39,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/download-workflow-run-artifact
         with:
diff --git a/.github/workflows/windows-ci.yml b/.github/workflows/windows-ci.yml
index 0c387aa42..5ac47ef1b 100644
--- a/.github/workflows/windows-ci.yml
+++ b/.github/workflows/windows-ci.yml
@@ -40,6 +40,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Get all Windows files that have changed
         if: github.event_name != 'workflow_dispatch'
@@ -66,6 +67,7 @@ jobs:
           sparse-checkout: |
             platform/windows/vendor
             platform/windows/Get-VendorPackages.ps1
+          persist-credentials: false
 
       - name: Get vcpkg commit id
         run: |
@@ -119,6 +121,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
@@ -255,6 +258,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - uses: msys2/setup-msys2@fb197b72ce45fb24f17bf3f807a388985654d1f2 # v2.29.0
         with:
diff --git a/vendor/maplibre-native-base/.github/workflows/ci.yml b/vendor/maplibre-native-base/.github/workflows/ci.yml
index 956c22d19..1dd77c922 100644
--- a/vendor/maplibre-native-base/.github/workflows/ci.yml
+++ b/vendor/maplibre-native-base/.github/workflows/ci.yml
@@ -25,6 +25,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
 
       - name: Build and run tests
         run: |