From f09281dabe85fae6762aefa24bd6c69d26a6b958 Mon Sep 17 00:00:00 2001
From: paketo-bot <paketobuildpacks@gmail.com>
Date: Thu, 15 Oct 2026 13:36:07 +0000
Subject: [PATCH] Updating github-config

---
 .github/workflows/update-dependencies-from-metadata.yml | 5 +++--
 .github/workflows/update-github-config.yml              | 5 +++--
 .github/workflows/update-go-mod-version.yml             | 5 +++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/update-dependencies-from-metadata.yml b/.github/workflows/update-dependencies-from-metadata.yml
index 8ef52dfc..fdc44ebf 100644
--- a/.github/workflows/update-dependencies-from-metadata.yml
+++ b/.github/workflows/update-dependencies-from-metadata.yml
@@ -325,15 +325,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        # zizmor: ignore[artipacked] -- persistent credentials required for push-branch
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
+          persist-credentials: false
 
       - name: Checkout Branch
         uses: paketo-buildpacks/github-config/actions/pull-request/checkout-branch@main
         with:
           branch: automation/dependencies/update-from-metadata
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Make Temporary Artifact Directory
         id: make-outputdir
@@ -396,6 +396,7 @@ jobs:
         uses: paketo-buildpacks/github-config/actions/pull-request/push-branch@main
         with:
           branch: automation/dependencies/update-from-metadata
+          token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
 
       - name: Open Pull Request
         if: ${{ steps.commit.outputs.commit_sha != '' }}
diff --git a/.github/workflows/update-github-config.yml b/.github/workflows/update-github-config.yml
index c7e5a0d6..a94bf3e0 100644
--- a/.github/workflows/update-github-config.yml
+++ b/.github/workflows/update-github-config.yml
@@ -19,10 +19,9 @@ jobs:
     steps:
 
     - name: Checkout
-      # zizmor: ignore[artipacked] -- persistent credentials required for push-branch
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
-        token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
+        persist-credentials: false
 
     - name: Checkout github-config
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -35,6 +34,7 @@ jobs:
       uses: paketo-buildpacks/github-config/actions/pull-request/checkout-branch@main
       with:
         branch: automation/github-config/update
+        token: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Run the sync action
       uses: paketo-buildpacks/github-config/actions/sync@main
@@ -59,6 +59,7 @@ jobs:
       uses: paketo-buildpacks/github-config/actions/pull-request/push-branch@main
       with:
         branch: automation/github-config/update
+        token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
 
     - name: Open Pull Request
       if: ${{ steps.commit.outputs.commit_sha != '' }}
diff --git a/.github/workflows/update-go-mod-version.yml b/.github/workflows/update-go-mod-version.yml
index b1527fee..3919e295 100644
--- a/.github/workflows/update-go-mod-version.yml
+++ b/.github/workflows/update-go-mod-version.yml
@@ -18,14 +18,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        # zizmor: ignore[artipacked] -- persistent credentials required for push-branch
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
+          persist-credentials: false
       - name: Checkout PR Branch
         uses: paketo-buildpacks/github-config/actions/pull-request/checkout-branch@main
         with:
           branch: automation/go-mod-update/update-main
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Go
         id: setup-go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -73,6 +73,7 @@ jobs:
         uses: paketo-buildpacks/github-config/actions/pull-request/push-branch@main
         with:
           branch: automation/go-mod-update/update-main
+          token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
 
       - name: Open Pull Request
         if: ${{ steps.commit.outputs.commit_sha != '' }}