chore(ci): do not persist credentials on checkout

Author: scop

.github/workflows/check-tag.yml

@@ -14,6 +14,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Run checks
         run: |
           grep -P --color=always "\s+(?<=rev: )$GITHUB_REF_NAME$" README.md

.github/workflows/check.yml

@@ -15,6 +15,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       # No caching as we're expected to run rarely
       - name: Install dependencies and run checks
         run: |