chore: Set persist-credentials false on pull-request workflows

.github/workflows/build-and-test.yml

@@ -22,6 +22,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Setup Go
@@ -111,6 +112,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
@@ -163,6 +166,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
 
       - name: Validate Unity Package structure
         run: |

.github/workflows/code-complexity.yml

@@ -25,6 +25,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c

.github/workflows/pr-title.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c

.github/workflows/security-scan.yml

@@ -47,6 +47,8 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      with:
+        persist-credentials: false
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
@@ -98,6 +100,8 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      with:
+        persist-credentials: false
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c

.github/workflows/unity-compile-check-and-test-runner.yml

@@ -39,6 +39,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           # Full history is required so the change-detection step can diff the
           # PR head against its base.
           fetch-depth: 0

cli/release-automation/internal/architecture/github_actions_security_test.go

@@ -61,6 +61,32 @@ func TestPullRequestWorkflowsDisableSetupGoCache(t *testing.T) {
 	}
 }
 
+// Tests that checkout does not persist GITHUB_TOKEN in pull request workflows.
+func TestPullRequestWorkflowsDisableCredentialPersistence(t *testing.T) {
+	repositoryRoot := findRepositoryRoot(t)
+	violations := []string{}
+	for _, workflowPath := range workflowFilePaths(t, repositoryRoot) {
+		lines := readWorkflowLines(t, workflowPath)
+		if !workflowRunsOnPullRequest(lines) {
+			continue
+		}
+		for lineIndex, line := range lines {
+			actionRef, ok := parseUsesAction(line)
+			if !ok || actionRepository(actionRef) != "actions/checkout" {
+				continue
+			}
+			if stepContains(lines, lineIndex, "persist-credentials: false") {
+				continue
+			}
+			violations = append(violations, workflowViolation(repositoryRoot, workflowPath, lineIndex, actionRef, "set persist-credentials: false for checkout in pull request workflows"))
+		}
+	}
+	if len(violations) > 0 {
+		sort.Strings(violations)
+		t.Fatalf("pull request checkout credential persistence policy violations:\n%s", strings.Join(violations, "\n"))
+	}
+}
+
 // Tests that pull request workflow cache actions are guarded behind trusted Unity secrets.
 func TestPullRequestWorkflowCacheActionsRequireTrustedUnitySecrets(t *testing.T) {
 	repositoryRoot := findRepositoryRoot(t)

docs/github-actions-security.md

@@ -19,3 +19,10 @@ Use `cache: false` for `actions/setup-go` in workflows triggered by
 
 Unity `actions/cache` steps in pull request workflows must stay behind the Unity
 license secret guard so forked pull requests cannot use those cache entries.
+
+`actions/checkout` steps in workflows triggered by `pull_request` or
+`pull_request_target` must set `persist-credentials: false`. By default checkout
+writes `GITHUB_TOKEN` into the local Git config, so any repository script or test
+that the workflow runs from the pull request branch can read it. Release
+workflows that genuinely push back to the repository are the only place where
+credential persistence is appropriate.