CI: restore persist-credentials: false on claude-code-review.yml's checkout step

[jnasbyupgrade]

The fork-checkout fix (removing the repository:/ref: override so this step checks out the base branch instead of an untrusted PR ref) was applied by deleting the whole with: block under actions/checkout, which also silently dropped persist-credentials: false. This job's permissions include pull-requests: write, a real write-capable credential; nothing here legitimately runs git push (review comments post via the API/claude-code-action, not git), so there's no reason to leave that credential sitting in .git/config for the rest of the job to misuse if anything later goes wrong.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 18a1281b-4485-42a6-b5f5-e5d4e02700f9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @jnasbyupgrade's task in 1m 10s —— View job

---

Claude's Review

• Gather context (diff, workflow file, repo guidelines)
• Understand the request (code review of this PR)
• Review the change for correctness/security
• Post final review feedback

Summary: This is a clean, minimal, well-justified fix. It restores persist-credentials: false on the Check out base branch step in .github/workflows/claude-code-review.yml (lines 111-119), which was inadvertently dropped when an earlier fix removed the ref:/repository: override to stop the job from checking out an untrusted PR ref.

Why this is correct:

• actions/checkout defaults persist-credentials to true, which writes a write-capable GITHUB_TOKEN into .git/config for the rest of the job.
• This job's permissions block (lines 41-49) grants pull-requests: write and actions: write — real write scopes.
• Nothing in this job legitimately needs to git push; the review is posted via the GitHub API through claude-code-action, not via git. So there's no legitimate use for that credential sitting in the workspace, and removing it reduces the blast radius if a later step in the job is ever compromised (e.g. via a supply-chain issue in a dependency/action).
• The diff only adds the with: persist-credentials: false block — it does not reintroduce the ref:/repository: override that was correctly removed for the fork-checkout security fix, so it doesn't regress that prior fix.
• YAML structure/indentation matches the pattern used by the other with: block later in the same file (checkout step: with: at the step's indent level, keys nested one level deeper).

No issues found — this is a straightforward, correctly-scoped security hardening change with a clear explanatory comment. Nothing to change.

[jnasbyupgrade]

Superseded by #33 — cherry-picked this commit (cb55096) into that PR instead of merging both separately.