[OskarEichler]

Issue

The release-tag documentation job grants contents: write. actions/checkout persists the repository token in local Git configuration by default, so npm lifecycle scripts and the documentation build run while that write-capable credential is available in the workspace.

Exploitation requires malicious code to enter a build dependency or script, but that code could read the persisted credential and push repository changes before the deployment step.

Fix

Set persist-credentials: false on the documentation checkout. The later Pages action already receives github.token explicitly, so deployment behavior remains intact while install and build steps no longer inherit a Git credential.

Verification

• Confirmed from the pinned checkout action metadata that persist-credentials defaults to true
• The workflow parses successfully as YAML
• git diff --check passed

Breaking changes

None.