pybuilder / pybuilder / 23674174413

83%

push

github

Fix release: persist-credentials false, stop inner token generation [release] (#945)

## Summary

Two fixes for release token not bypassing branch protection rulesets:

1. **`persist-credentials: false`** on all `actions/checkout@v6` steps —
prevents the default `GITHUB_TOKEN` credential helper from persisting
and overriding the app token during `git push`

2. **Stop passing `release-app-id`/`release-app-private-key` to inner
`pybuilder/build` action** — the inner action was generating its own
token inside the double-nested composite action context, which didn't
bypass rulesets. Now only the token generated at `.github/action.yml`
level (single nesting, like karellen repos) is used.

## Test plan

- [ ] Merge and verify release push to master succeeds
- [ ] Verify v0.13.19 tag is created and PyPI upload completes

1404 of 1856 branches covered (75.65%)

Branch coverage included in aggregate %.

5552 of 6528 relevant lines covered (85.05%)

33.07 hits per line