ci: minimize workflow credential exposure

Author: julienld

.github/workflows/addon-publish-dev.yml

@@ -59,6 +59,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           # Full history: the dev version number is the commit count.
           fetch-depth: 0
 
@@ -102,6 +103,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
+        persist-credentials: false
         submodules: true
 
     - name: Set up Docker Buildx

.github/workflows/addon-publish.yml

@@ -41,6 +41,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
+        persist-credentials: false
         submodules: true
         # Check out the release tag so uv sync installs the bumped pyproject.toml.
         # Without this, GITHUB_SHA points to the pre-semantic-release merge commit

.github/workflows/build-haos-test-image.yml

@@ -59,6 +59,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           # Required for the skills bundle submodule at
           # src/ha_mcp/resources/skills-vendor (test_skills_resources.py).
           submodules: true

.github/workflows/codeql-quality.yml

@@ -71,6 +71,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7

.github/workflows/haos-e2e-embedded-tests.yml

@@ -67,6 +67,8 @@ jobs:
       run: ${{ steps.filter.outputs.run }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Classify changed files
         id: filter
         env:
@@ -135,6 +137,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           # Required for tests/src/e2e/tools/test_skills_resources.py — the
           # skills bundle lives at src/ha_mcp/resources/skills-vendor.
           submodules: true

.github/workflows/haos-e2e-inaddon-tests.yml

@@ -70,6 +70,8 @@ jobs:
       run: ${{ steps.filter.outputs.run }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Classify changed files
         id: filter
         env:
@@ -133,6 +135,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           submodules: true
           # Full history so merge-ref git operations resolve cleanly.
           fetch-depth: 0

.github/workflows/validate.yml

@@ -18,6 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: HACS validation
         uses: hacs/action@1ebf01c408f29afcb6406bd431bc98fd8cbb15aa # main
         with:
@@ -28,6 +30,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       # Drop vendored third-party fixtures (e.g. the upstream HACS integration
       # used as an e2e fixture) so hassfest only validates integrations this repo
       # owns. Mirrors scripts/codeql_quality_gate.py's PATHS_IGNORE convention.

.github/workflows/webhook-proxy-dev-version-guard.yml

@@ -14,6 +14,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Require a dev version bump and config/manifest parity
         env:

.github/workflows/webhook-proxy-stable-guard.yml

@@ -26,6 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Block direct stable edits outside the promote workflow