fix(actions): secure workflows (#259)

.github/workflows/deploy-docs.yaml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -65,6 +67,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: gh-pages
+          persist-credentials: false
 
       - name: Setup Pages
         uses: actions/configure-pages@v4

.github/workflows/mypy.yaml

@@ -16,10 +16,11 @@ jobs:
         pyversion: [ "3.8", "3.9", "3.10", "3.11", "3.12" ]
 
     steps:
-      - name: Checkout
-        uses: actions/[email protected]
-        with:
-          fetch-depth: 0
+    - name: Checkout
+      uses: actions/[email protected]
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Python (faster than using Python container)
       uses: actions/setup-python@v5

.github/workflows/pytest.yaml

@@ -39,6 +39,8 @@ jobs:
     steps:
       - name: Check out repository code
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Setup Python (faster than using Python container)
         uses: actions/setup-python@v5

.github/workflows/release.yaml

@@ -18,6 +18,7 @@ jobs:
       uses: actions/[email protected]
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Python
       uses: actions/setup-python@v5