ci: disable persisted credentials and correct action version pin comments

[tkislan]

Closes #444

Summary

Two related hardening/hygiene changes to the GitHub Actions workflows:

1. persist-credentials: false on every actions/checkout step, so the GitHub token is not written into the local Git config while repository-controlled npm commands (npm ci, npm install, npm run package, npx better-npm-audit, …) run in those jobs.
2. Full versions in the action pin comments, which had drifted far enough from the SHAs they annotate to be actively misleading.

Follow-up to the review comment on #422 (discussion_r3613084710).

---

1. Disable persisted credentials

Workflow	Checkout steps updated
.github/workflows/cd.yml	1 (package)
.github/workflows/ci.yml	9 (lint, typecheck, qlty, build, check_licenses, spell-check, package-lock-drift-check, audit-prod, audit-all)
.github/workflows/deps.yml	2 (audit, check-deps)
.github/workflows/e2e.yml	0 — already set, unchanged

Why this is safe

Every affected job is read-only — none pushes, tags, or otherwise consumes the persisted credentials, and each workflow's permissions: block is already contents: read. Two jobs touch git and were checked specifically:

• qlty keeps its fetch-depth: 0. persist-credentials: false only strips the auth header after the fetch completes, so full history is still cloned.
• package-lock-drift-check runs git diff --exit-code HEAD, a purely local operation that needs no credentials.

---

2. Correct the action version comments

The # vX comments next to the SHA-pinned actions no longer matched the SHAs. Most visibly, every actions/checkout and actions/setup-node pin was commented # v6 while the SHA was already v7.x — the bots had bumped the hashes but the comments were left behind, so the pins read as several majors out of date at a glance.

Each pinned SHA was resolved against the GitHub tags API and the comment rewritten to the full version it actually corresponds to:

Action	Comment was	Actual version	SHA changed?
actions/checkout	# v6 ❌	# v7.0.1	no
actions/setup-node	# v6 ❌	# v7.0.0	no
codecov/codecov-action	# v7 (partial)	# v7.0.0	no
actions/upload-artifact	# v7.0.1 ✅	# v7.0.1	no
actions/setup-python	# v7.0.0 ✅	# v7.0.0	no
actions/cache	# v6.1.0 ✅	# v6.1.0	no
qltysh/qlty-action/install	(none)	# v2.3.0	yes — see below

27 comments corrected in total (13 checkout + 12 setup-node + 2 codecov-action). For all of these the pinned SHA is untouched; only the trailing comment changed, so nothing about what CI executes is different.

codecov/codecov-action@fb8b3582 carries both the v6.0.2 and v7.0.0 tags on the same commit; v7.0.0 was used, matching what Dependabot bumped it to in #408.

The one functional change: qltysh/qlty-action/install

This was the only pin that could not simply be re-commented. Its SHA 141b8812 is not a release — it is an ordinary commit on the action's main branch, 11 commits after v2.2.0 and 4 commits short of v2.2.1. There was no accurate version to write.

That is also why its bot PRs are titled a bare bump qltysh/qlty-action with no version numbers, unlike the version-bearing bump actions/checkout from 6.0.2 to 7.0.0: when a SHA-pinned action does not map to a release, Dependabot/Renovate fall back to tracking the branch-head digest. Tracing every pin this repo has held for it shows the drift is self-perpetuating — it sat on v1, then v2.2.0, then fell onto an untagged commit and stayed there for 8 consecutive bumps.

It is now pinned to 08a0a862 = v2.3.0, the latest release, so it can be tracked by version again like every other action here. This is the only change in the PR that alters what CI runs.

---

Merge with main

main bumped actions/checkout 7.0.0 → 7.0.1 (#447) while this branch was open, which conflicted with the persist-credentials: false additions in 11 checkout steps. Resolved in favour of main's newer pin plus this branch's setting — no checkout version was rolled back.

Verification

• All 13 checkout steps across the 4 workflows resolve to persist-credentials: false (12 added here + 1 pre-existing in e2e.yml).
• Every remaining pinned SHA re-checked against the GitHub tags API; each version comment matches a tag on exactly that commit.
• All 4 workflows parse as valid YAML.
• prettier --check '.github/workflows/*.yml' passes — .github/**/*.yml is covered by npm run format in CI.

Acceptance criteria

• Every actions/checkout step in the affected workflows sets persist-credentials: false.
• No checkout behavior unrelated to credential persistence is changed.
• The existing secure configuration in .github/workflows/e2e.yml remains unchanged (its checkout gains only a corrected version comment).
• Every SHA-pinned action carries a comment stating the full version that SHA actually resolves to.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YFmRiqkZebrHeTBTHdwV3z

Summary by CodeRabbit

• Security

  • Improved workflow security by preventing checkout steps from persisting GitHub credentials across build, validation, packaging, dependency checks, and auditing tasks.

• Chores

  • Corrected the version comments on all SHA-pinned GitHub Actions to reflect the versions actually in use, and repinned the qlty install action to a tagged release.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI, dependency, package, and E2E workflows update GitHub Actions references. Affected checkout steps set persist-credentials: false; setup-node and Codecov references are also updated in selected workflows.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• deepnote/vscode-deepnote#379: Updates overlapping GitHub Actions workflow steps.
• deepnote/vscode-deepnote#408: Updates the Codecov action version in ci.yml.
• deepnote/vscode-deepnote#422: Updates overlapping checkout configuration.

Suggested reviewers: m1so

🚥 Pre-merge checks | ✅ 3 | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The credential-persistence fix is present, but .github/workflows/e2e.yml and action version pins were also changed, exceeding the linked issue scope.	Limit changes to cd.yml, ci.yml, and deps.yml, keep e2e.yml unchanged, and avoid unrelated action version updates.
Out of Scope Changes check	⚠️ Warning	Updates to .github/workflows/e2e.yml and checkout/setup-node version pins are unrelated to disabling persisted credentials.	Remove the e2e workflow edits and any action-version-only changes unless they are required for the credential-persistence fix.
Updates Docs	❓ Inconclusive	Current diff only touches workflow YAMLs; I can't verify the OSS/internal docs repos from here.	If this change should be documented, update the relevant docs in deepnote/deepnote and the roadmap page in deepnote/deepnote-internal, then recheck.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main workflow change: disabling persisted checkout credentials, with the version-pin comment updates also reflected.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0%. Comparing base (c38ee10) to head (d987001).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@     Coverage Diff     @@
##   main   #445   +/-   ##
===========================
===========================

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[m1so]

LGTM ✅

(although there are now merge conflicts)