pybuilder / pybuilder / 23674174413 / 39

83%

master: 83%

push

github

Fix release: persist-credentials false, stop inner token generation [release] (#945)

## Summary

Two fixes for release token not bypassing branch protection rulesets:

1. **`persist-credentials: false`** on all `actions/checkout@v6` steps —
prevents the default `GITHUB_TOKEN` credential helper from persisting
and overriding the app token during `git push`

2. **Stop passing `release-app-id`/`release-app-private-key` to inner
`pybuilder/build` action** — the inner action was generating its own
token inside the double-nested composite action context, which didn't
bypass rulesets. Now only the token generated at `.github/action.yml`
level (single nesting, like karellen repos) is used.

## Test plan

- [ ] Merge and verify release push to master succeeds
- [ ] Verify v0.13.19 tag is created and PyPI upload completes

1277 of 1836 branches covered (69.55%)

Branch coverage included in aggregate %.

5232 of 6424 relevant lines covered (81.44%)

0.81 hits per line