fix(ci): keep release credentials out of the build checkout

.github/workflows/release.yml

@@ -33,9 +33,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
+          persist-credentials: false
       - name: Set up uv
         # Pinned to a full commit SHA (third-party action); comment tracks the tag.
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: "${{ env.UV_VERSION }}"
           enable-cache: true

tests/unit/test_github_release_workflow.py

@@ -39,6 +39,7 @@ def test_release_workflow_tags_the_merged_pr_commit() -> None:
     workflow = WORKFLOW.read_text(encoding="utf-8")
 
     assert "ref: ${{ github.event.pull_request.merge_commit_sha }}" in workflow
+    assert "persist-credentials: false" in workflow
     assert '--target "${{ github.event.pull_request.merge_commit_sha }}"' in workflow
 
 
@@ -56,7 +57,7 @@ def test_release_workflow_uses_skillspectors_locked_uv_environment() -> None:
     """Release artifacts are built with the repository's pinned tooling."""
     workflow = WORKFLOW.read_text(encoding="utf-8")
 
-    assert "astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5" in workflow
+    assert "astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2" in workflow
     assert 'UV_VERSION: "0.10.10"' in workflow
     assert 'version: "${{ env.UV_VERSION }}"' in workflow
     assert "cache-dependency-glob: uv.lock" in workflow