ci: disable checkout credential persistence in the windows-build job

[proggeramlug]

Follow-up to the CodeRabbit/zizmor finding on the merged #6610: the new windows-build job's checkout persisted the workflow token in .git/config while compiling PR-controlled build scripts and proc macros. One-line fix: persist-credentials: false.

Note for the maintainer: 16 of the 17 checkout steps in test.yml share the same default (only one job sets persist-credentials today). Sweeping the rest is deliberately NOT in this PR - some jobs may rely on the persisted token (e.g. anything that pushes or uses gh with the ambient credential) and each needs individual verification.

No version bump / changelog per maintainer instruction.

Summary by CodeRabbit

• Chores
  • Improved Windows build security by preventing workflow credentials from being persisted in the repository checkout.
  • Build processes can continue reading repository contents without exposing the workflow token through Git configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8c428061-173a-454e-9f6c-907bc19b6582

📥 Commits

Reviewing files that changed from the base of the PR and between fac2bbe and 823d68f.

📒 Files selected for processing (1)

• .github/workflows/test.yml

---

📝 Walkthrough

Walkthrough

The Windows build workflow updates its checkout step to disable persisted credentials in the repository configuration.

Changes

Windows checkout credential handling

Layer / File(s)	Summary
Disable persisted checkout credentials .github/workflows/test.yml	The windows-build checkout step sets persist-credentials: false.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• PerryTS/perry#6610: Introduces the windows-build job modified by this change.

Suggested reviewers: andrewtdiz, thehypnoo

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	It explains the change and rationale, but it misses required template sections like Related issue, Test plan, and Checklist.	Fill in the template sections with a brief Changes list, Related issue, Test plan, optional Screenshots/output, and the checklist.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly names the main change: disabling checkout credential persistence in the windows-build job.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/windows-build-persist-credentials

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}