Resolve 'credential persistence through GitHub Actions artifacts' warnings from Zizmor

[pankajkoti]

The persist-credentials option in the actions/checkout action determines whether the Git credentials used to fetch the repository are left in the Git configuration after the checkout step. Setting persist-credentials to true (the default) means the credentials will remain, allowing subsequent steps in the workflow to perform authenticated Git operations without re-authentication. Setting it to false removes the credentials, which is useful for security when you don't want later steps to have access to the credentials.

scan results from this PR: https://github.com/astronomer/astronomer-cosmos/security/code-scanning?query=is%3Aopen+pr%3A1890

vs

on main: https://github.com/astronomer/astronomer-cosmos/security/code-scanning (this will change after merging this PR, but can be compared while the PR is still open)

related: https://github.com/astronomer/oss-integrations-private/issues/156

[netlify]

✅ Deploy Preview for sunny-pastelito-5ecb04 canceled.

Name	Link
🔨 Latest commit	b20acb2
🔍 Latest deploy log	https://app.netlify.com/projects/sunny-pastelito-5ecb04/deploys/68839b60b728b00008d49af6

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.91%. Comparing base (fdf0f72) to head (b20acb2).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1890      +/-   ##
==========================================
- Coverage   97.91%   97.91%   -0.01%     
==========================================
  Files          85       85              
  Lines        5330     5329       -1     
==========================================
- Hits         5219     5218       -1     
  Misses        111      111              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This PR addresses security warnings from Zizmor by adding persist-credentials: false to all actions/checkout@v4 steps across GitHub Actions workflows. This prevents Git credentials from persisting after checkout, reducing the risk of credential exposure in subsequent workflow steps.

• Adds persist-credentials: false to all checkout actions in the test workflow
• Updates deploy and CodeQL workflows to disable credential persistence
• Improves security posture by following the principle of least privilege for Git credentials

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/test.yml	Adds persist-credentials: false to 10 checkout steps across various test jobs
.github/workflows/deploy.yml	Adds with block and persist-credentials: false to the checkout step
.github/workflows/codeql.yml	Adds with block and persist-credentials: false to the checkout step

[tatiana]

Excellent work, @pankajkoti ! Thanks for improving the security of our repo.