fix(security): drop persisted credentials before dependency lifecycle code

[seonghobae]

Security boundary

BandScope dependency-lifecycle workflows must not leave checkout credentials persisted in Git configuration while untrusted npm/Python dependency code executes. Protected develop already had a compliant cross-platform build boundary, and canonical #783 owns the equivalent ci.yml hardening; exact-current-code inspection found three BandScope-owned remaining lifecycle paths with default checkout credential persistence: security-audit, release, and bandit.

Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
Exact current head: f4f2e2ebf24ac33468035a67389d06e998eaf1c3.
Draft retained.

Test-first repair

The branch first added a repository contract test that extracts the checkout step itself and requires persist-credentials: false for:

• .github/workflows/security-audit.yml;
• .github/workflows/release.yml; and
• .github/workflows/bandit.yml.

The helper deliberately stops at the next workflow step, so a later action's unrelated persist-credentials: false cannot satisfy the checkout contract. A separate regression locks that false-positive boundary.

The first exact workflow attempt after broadening the contract failed in release-preflight at Ruff import ordering before reaching the substantive assertion. That exact job/log was inspected before further editing, and the test was made formatter-clean. Source-level comparison on the resulting RED contract proved security-audit compliant while release and bandit still lacked the checkout option; queued runs were not counted as executed RED evidence.

Production repair then added only:

with:
  persist-credentials: false

to the checkout steps in release.yml and bandit.yml. The existing security-audit.yml repair remains unchanged. CHANGELOG.md and docs/security/dependency-policy.md describe the lifecycle credential boundary.

Ownership / non-duplication

This PR changes only BandScope-owned workflow/test/policy surfaces. It deliberately does not modify ci.yml, because canonical dependency-security PR #783 already owns the relevant CI checkout-credential hardening together with the coordinated npm/PDF.js/Nanoid/Undici baseline. build-baseline.yml was already compliant. CodeQL lifecycle files remain owned by #780.

No dependency version, root lockfile, vulnerability suppression, review-agent credential, application permission, database, model, network, filesystem, or IPC authority is added or weakened.

Security rationale

actions/checkout supports disabling persisted credentials. Dependency installation and audit steps execute code supplied by dependency ecosystems; those steps do not require authenticated Git writes. Removing the persisted checkout credential therefore reduces ambient authority without weakening repository read access, security gates, or release evidence.

Exact-current-head evidence

A fresh repository workflow cycle has been emitted for exact head f4f2e2ebf24ac33468035a67389d06e998eaf1c3. At the latest refresh all nine repository workflows were still queued, so none is counted as current success:

• ci 31987203171;
• bandit 31987203198;
• security-audit 31987203217;
• build-baseline 31987203284;
• sbom 31987203267;
• secret-scan-gate 31987203294;
• release 31987203352;
• SAST Semgrep 31987203252; and
• aggregate Security Scan 31987203226.

Any failed exact-head job must be inspected at job/check-run/annotation/log level before another edit or rerun. If whole-tree npm/Trivy findings reproduce the protected-base nanoid / pdfjs-dist / undici set, classify them as inherited #783 evidence only after that exact-current-head inspection; never suppress or duplicate them here.

Dependency / review order

Canonical #783 must establish the protected JavaScript dependency-security baseline. Current central required-workflow repair is read-only and follows the live .github prerequisite chain; historical .github#1008 is closed unmerged and transfers no evidence. Reviewer-agent dispatches must not be repeated merely to reproduce an unchanged central prerequisite.

There is no qualifying independent non-author last-push approval for this exact head.

Merge gate

Keep Draft and unmerged until the unchanged then-current head has terminal-success repository and central CI, exact owned statement/branch coverage and docstrings where applicable, SAST/security/SBOM/supply-chain/package/release evidence, zero valid unresolved findings, canonical dependency/central prerequisites integrated and regenerated, a qualifying independent non-author last-push approval, and ordinary branch-protection acceptance. Queued, skipped-required, failed, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is not success.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 18749509-a4f2-4edd-b728-ad37680996bf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}