chore: pin checkout, stop persisting credentials and cover main.py fully

.github/workflows/commit-check.yml

@@ -16,9 +16,11 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # Required for merge-base checks
+          # Nothing after checkout needs authenticated git.
+          persist-credentials: false
       - uses: ./ # self test
         with:
           message: true

.github/workflows/coverage.yml

@@ -14,6 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing after checkout needs authenticated git.
+          persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # 3.10 is the real floor, see test.yml

.github/workflows/test.yml

@@ -27,6 +27,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing after checkout needs authenticated git.
+          persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.py }}

.github/workflows/used-by.yml

@@ -15,6 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # create-pull-request authenticates its own push, so the token
+          # is not left in .git/config for the steps in between.
+          persist-credentials: false
       - uses: shenxianpeng/used-by@4c0501cd4b6370c275b50d46400538ae90b8e7a9 # v0.1.5
         with:
           repo: '${{ github.repository }}'