From 85e8ac13132f71287bdf7adb6db04620c0d772e9 Mon Sep 17 00:00:00 2001
From: Phani Puttabakula <phani.p@bluefunda.com>
Date: Sun, 7 Jun 2026 01:42:35 +0000
Subject: [PATCH] fix(go-ci): move checkout before PAT config, add
 persist-credentials: false (#56)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/go-ci.yml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index 772407d..4e34f84 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -53,6 +53,10 @@ jobs:
     env:
       GOPRIVATE: ${{ inputs.goprivate }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Configure Git for private modules
         if: inputs.goprivate != ''
         env:
@@ -62,8 +66,6 @@ jobs:
             git config --global url."https://${GH_PAT}@github.com/".insteadOf "https://github.com/"
           fi
 
-      - uses: actions/checkout@v4
-
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '' }}
@@ -96,6 +98,10 @@ jobs:
     env:
       GOPRIVATE: ${{ inputs.goprivate }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Configure Git for private modules
         if: inputs.goprivate != ''
         env:
@@ -105,8 +111,6 @@ jobs:
             git config --global url."https://${GH_PAT}@github.com/".insteadOf "https://github.com/"
           fi
 
-      - uses: actions/checkout@v4
-
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '' }}
@@ -133,6 +137,10 @@ jobs:
     env:
       GOPRIVATE: ${{ inputs.goprivate }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Configure Git for private modules
         if: inputs.goprivate != ''
         env:
@@ -142,8 +150,6 @@ jobs:
             git config --global url."https://${GH_PAT}@github.com/".insteadOf "https://github.com/"
           fi
 
-      - uses: actions/checkout@v4
-
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '' }}