Add persist-credentials: false to actions/checkout uses, fix up mik…

…e action

Based on zizmor's findings.

Fixing mike works by supplying the shell command-line inputs as envvars, since
they are always fully expanded by the shell, preventing surprise injections at
the template level.

.github/actions/mike-docs/action.yaml

@@ -26,10 +26,13 @@ runs:
     shell: bash
   - env:
       DOCS_PRERELEASE: ${{ inputs.pre_release }}
+      INPUTS_PUSH: ${{ inputs.push }}
+      INPUTS_VERSION: ${{ inputs.version }}
+      INPUTS_ALIAS: ${{ inputs.alias }}
     run: |
       MIKE_OPTIONS=( "--update-aliases" )
-      if [ "true" = "${{ inputs.push }}" ]; then
+      if [ "true" = "${INPUTS_PUSH}" ]; then
         MIKE_OPTIONS+=( "--push" )
       fi
-      uv run mike deploy ${{ inputs.version }} ${{ inputs.alias }} "${MIKE_OPTIONS[@]}"
+      uv run mike deploy "${INPUTS_VERSION}" ${INPUTS_ALIAS} "${MIKE_OPTIONS[@]}"
     shell: bash

.github/workflows/lint-and-test.yaml

@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v5
         with:
@@ -30,6 +32,8 @@ jobs:
         python-version: [ "3.10", 3.11, 3.12, 3.13 ]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v5
         with:
@@ -43,6 +47,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v5
         with:

.github/workflows/release.yaml

@@ -15,6 +15,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v5
         with: