ci: drop persisted Git credentials in actions/checkout (Aikido)

[dorothyyzh]

Summary

Aikido flags actions/checkout for leaving the job token in .git/config (http.extraheader) after checkout, where any later step — including third-party actions — can read it. This repo accounts for 4 of the 10 sub-issues in that group.

Added persist-credentials: false to all four workflows.

No-op for three of them — they run no git operations after checkout:

• go.yml — go build / go test
• vuetifyjs-test.yml — pnpm install / build / test:unit
• doc-build.yml — peaceiris/actions-gh-pages authenticates via its own github_token input, not the ambient credential

vuetifyjs-build.yml needed a real change. It pushes the rebuilt dist bundle back to the PR branch, so the push is now authenticated explicitly through a token URL instead of relying on the credential checkout used to leave behind:

-  git push origin HEAD:${{ github.head_ref }}
+  git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${REPOSITORY}.git" "HEAD:${HEAD_REF}"

While rewriting that line I also moved github.head_ref into the environment. Interpolating ${{ github.head_ref }} straight into a run: block is a script-injection vector — a branch name containing shell metacharacters executes in the job. Passing it via env: makes it inert data.

Aikido Issues Resolved

Group 33607621 — 4 sub-issues in this repo:

• 374028910
• 374028914
• 374028917
• 374028920

Verification

• All four workflow files parse as valid YAML
• No source changes — dist/ is untouched, so no bundle rebuild is needed here
• The vuetifyjs-build push path is only exercised when the built dist actually differs; reviewers wanting to confirm it should watch the first PR after merge that changes ui/vuetifyx/vuetifyxjs sources

Note

Branch is fix/aikido-persist-credentials-2026-07-27 rather than the usual dated name — fix/aikido-dependency-vulnerabilities-2026-07-27 is already taken by #621.

[dorothyyzh]

Superseded by #624 — same commits replayed on a fresh branch off the current default branch (fix/aikido-2026-08-06). The explicit-token push in vuetifyjs-build.yml is carried over unchanged. Verified with the doctor-lint check GH_CHECKOUT_CREDENTIALS_PERSISTED and re-parsed with a real YAML parser.