From 32f6ba2dd9e0f041044cc3ab1faac5485f32e297 Mon Sep 17 00:00:00 2001
From: Eli <88557639+lishaduck@users.noreply.github.com>
Date: Wed, 30 Oct 2024 21:41:24 -0500
Subject: [PATCH] ci: improve checkout

Always set `persist-credentials` to false, it's a major security risk.
It gives any code that executes afterward the same access as the GITHUB_TOKEN.
While we explicitly set `permissions`, if you change it, you might overlook this.
See also: actions/checkout#485.
---
 .github/workflows/test.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e52a73b6e..47ca7b8c4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -41,7 +41,13 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - name: Git checkout
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        submodules: recursive
+        clean: true
+        persist-credentials: false
+        set-safe-directory: true
 
     - name: Setup Node.js environment
       uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2