What does 'persist-credentials: false' do in actions/checkout?
Select an answer to reveal the explanation.
Short Explanation and Infographic
persist-credentials: false removes the token from git's credential store after checkout — so later steps can't accidentally use it for git operations.
Full explanation below image
Full Explanation
By default, actions/checkout configures the local git instance with GITHUB_TOKEN credentials so subsequent git commands in the job work without additional authentication. 'persist-credentials: false' removes these credentials after checkout, meaning subsequent git operations in the same job will fail without separate authentication. This is a security hardening option — if a malicious step later in the job runs 'git push', it won't have credentials to do so. Use this when: you don't need git operations after checkout, or you want to use a different credential set for git operations. The checkout itself still works normally.