chore: improve workflows

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: npm
     directory: "/"
     groups:
@@ -13,3 +15,5 @@ updates:
         dependency-type: production
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/codeql.yaml

@@ -29,6 +29,7 @@ jobs:
           # a pull request then we can checkout the head of the pull request.
           # Only include this option if you are running this workflow on pull requests.
           fetch-depth: 2
+          persist-credentials: false
 
       # If this run was triggered by a pull request event then checkout
       # the head of the pull request instead of the merge commit.

.github/workflows/test.yml

@@ -20,6 +20,8 @@ jobs:
         with:
           node-version: 24.x
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - run: |
           npm install
           npm run all
@@ -48,6 +50,8 @@ jobs:
       pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -81,6 +85,8 @@ jobs:
       pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -111,6 +117,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -143,6 +151,8 @@ jobs:
       pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -170,6 +180,8 @@ jobs:
       pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x