Disable checkout credential persistence so repository-controlled code run by npm ci/test cannot read GITHUB_TOKEN from .git/config, and pin actions to full commit SHAs to guard against mutable-tag supply-chain attacks.
Ivan Pereira