ci: don't persist credentials in lint/test checkout steps

[kilo-code-bot]

Background

actions/checkout persists the GITHUB_TOKEN in the local git config by default, so any step that later reads git config (e.g. a compromised dependency step) could exfiltrate it.

Problem

The lint and test jobs in python-package.yml never push commits or run authenticated git commands, so the persisted credentials are pure risk with no benefit.

What this PR changes

Adds persist-credentials: false to the two pre-existing actions/checkout@v7 steps (lint and test jobs). Flagged by CodeRabbit on #65; kept out of that PR since it's unrelated to the parallelization work there.

Tests

CI still runs (lint, full test matrix, coverage) and passes — the change only affects token persistence, not job behavior.

Summary by CodeRabbit

• Chores
  • Improved CI security by preventing checkout credentials from being persisted during automated linting and testing workflows.

[what-the-diff]

PR Summary

• Added Configuration to GitHub Actions Workflow
  The configuration of some of our automated processes (specifically, in two steps of the GitHub Actions workflow) has been updated. This update will prevent GitHub from remembering users' credentials after tasks are completed, enhancing the security of our software.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.37%. Comparing base (955101f) to head (f99fc7e).

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #85   +/-   ##
=======================================
  Coverage   96.37%   96.37%           
=======================================
  Files          17       17           
  Lines         496      496           
=======================================
  Hits          478      478           
  Misses         18       18           

Flag	Coverage Δ
no-numba	95.76% <ø> (ø)
numba	88.10% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[endolith]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a2cf127c-22df-4d55-861d-aaec121e47d2

📥 Commits

Reviewing files that changed from the base of the PR and between 955101f and f99fc7e.

📒 Files selected for processing (1)

• .github/workflows/python-package.yml

---

📝 Walkthrough

Walkthrough

Changes

Workflow credential handling

Layer / File(s)	Summary
Disable persisted checkout credentials .github/workflows/python-package.yml	The lint and test checkout steps now set persist-credentials: false.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: endolith

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes disabling credential persistence in the lint and test checkout steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/persist-credentials

---

_{Comment @coderabbitai help to get the list of available commands.}