transformers

9a6a9542 - fix(ci): set persist-credentials: false on actions/checkout and close remaining template injection findings (#45964)

fix(ci): set persist-credentials: false on actions/checkout and close remaining template injection findings (#45964) `actions/checkout` defaults to writing the `GITHUB_TOKEN` into the checked-out repo's `.git/config` (`extraheader: AUTHORIZATION: basic ...`). That file is then included by `actions/upload-artifact` unless explicitly excluded, leaking a valid token to any artifact consumer (potentially including PR authors via downstream `workflow_run` consumers). Set `persist-credentials: false` on every `actions/checkout` invocation that does not subsequently `git push`. Workflows that need to push still keep credentials persistence (they re-authenticate explicitly when needed via x-access-token URLs). Also fixes every remaining `template-injection` finding zizmor flagged (both warning- and help-level): values from `inputs.*` / `matrix.*` / `env.*` that were interpolated into `run:` blocks are now passed via `env:` and referenced with `"$VAR"`. Where the env var is already exported by a previous step via `$GITHUB_ENV` (e.g. `env.machine_type`, `env.split_keys`), the GitHub-templated reference is replaced by a plain shell reference (`$machine_type`). Zizmor 1.24.1, before -> after: - 42 `warning[artipacked]` -> 0 - 15 `warning[template-injection]` -> 0 - 22 `help[template-injection]` -> 0 No behavior change.