Disable credential persistence on the agentic_commands router checkout

[Copilot]

The generated central slash-command router workflow (.github/workflows/agentic_commands.yml) checked out the repo without persist-credentials: false, leaving GITHUB_TOKEN in the local git config for the lifetime of the routing job. The router only needs the tree (it loads actions/setup scripts and dispatches), so persisted credentials are pure blast radius.

Changes

• pkg/workflow/central_slash_command_workflow.go — emit with: persist-credentials: false on the router's actions/checkout step.
• pkg/workflow/central_slash_command_workflow_test.go — TestGenerateCentralSlashCommandWorkflow_CheckoutDoesNotPersistCredentials asserts the full checkout block (step name + pinned uses + with) and that persist-credentials: true never appears in the generated output.
• .github/workflows/agentic_commands.yml — regenerated via make recompile.
• Changeset added.

Generated output:

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

Note: the custom Go linter reports function-length and path-concatenation findings in central_slash_command_workflow.go. These reproduce on the unmodified baseline and are left untouched.

[Copilot]

🟢 Approval recommended

The focused change consistently updates generator output, regression coverage, generated workflow, and release metadata.

Pull request overview

Prevents the generated slash-command router from persisting checkout credentials, reducing credential exposure.

Changes:

• Adds persist-credentials: false to the generated checkout step.
• Adds focused regression coverage and regenerates the workflow.
• Adds a patch changeset.

File summaries

File	Description
pkg/workflow/central_slash_command_workflow.go	Generates credential-free checkout configuration.
pkg/workflow/central_slash_command_workflow_test.go	Verifies credentials are not persisted.
.github/workflows/agentic_commands.yml	Applies the regenerated secure checkout block.
.changeset/central-commands-checkout-no-credentials.md	Records the security hardening change.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.89.12