fix: changeset PR update not running workflows

[nedsalk]

The FuelLabs/changesets-action@main action is supposed to trigger workflows in the changesets branch after it force-pushes commits because it's given the REPO_TOKEN - which is a personal access token (PAT) of our fuel-service-user - but the workflows aren't being run because apparently the GITHUB_TOKEN is still being used when the PR is updated.

Upon analyzing the discussions and linked PRs in changesets/action#70, it seems that stopping actions/checkout from persisting credentials (via persist-credentials: false) should do the trick.

closes #1734

Where's the bug?

The bug most probably lies somewhere in the interplay between actions/checkout which by default persists the GITHUB_TOKEN into git's local config and actions/toolkit which FuelLabs/changesets-action@main uses to interact with GitHub.

Important

It seems that the default behavior of persist-credentials:true is generally a security issue (actions/checkout#485). We should consider disabling it in all of our workflows.

[github-actions]

Coverage Report:

Lines	Branches	Functions	Statements
79.48%(+0%)	70.29%(+0%)	78.04%(+0%)	79.57%(+0%)

Changed Files:

Coverage values did not change👌.

[Dhaiwat10]

Nice one @nedsalk, might be a good idea to file a follow-up issue to disable persisting credentials for all workflows

[danielbate]

Nice one, hopefully this does the trick, more CI testing fun.

[arboleya]

Nice find! 🎯