fix: Set checkout GHA persist-credentials to false for push to succeed

[matthewfeickert]

Description

Fix the Tag Creator workflow that failed in PR #796 on the "Push changes" step with

Run ad-m/github-push-action@v0.5.0
  with:
    github_token: ***
    branch: master
    directory: .
  env:
    IS_MAJOR: false
    IS_MINOR: false
    IS_PATCH: true
    PR_NUMBER: 796
    PR_TITLE: build: Require minimum SciPy version of v1.4.0
    GITHUB_HEAD_REF: build/require-scipy-min-v-1.4.0
    BV_PART: patch
    pythonLocation: /opt/hostedtoolcache/Python/3.7.7/x64
    OLD_TAG: v0.4.1
    NEW_TAG: v0.4.2
    CHANGES: <there were a lot but they don't matter here>
    NUM_CHANGES: 48
/usr/bin/docker run --name be76db00e9f497df7b42a2802c9c7aa61823ab_e1ed51 --label be76db --workdir /github/workspace --rm -e IS_MAJOR -e IS_MINOR -e IS_PATCH -e PR_NUMBER -e PR_TITLE -e GITHUB_HEAD_REF -e BV_PART -e pythonLocation -e OLD_TAG -e NEW_TAG -e CHANGES -e NUM_CHANGES -e INPUT_GITHUB_TOKEN -e INPUT_REPOSITORY -e INPUT_BRANCH -e INPUT_FORCE -e INPUT_DIRECTORY -e HOME -e GITHUB_JOB -e GITHUB_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_REPOSITORY_OWNER -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_ACTOR -e GITHUB_WORKFLOW -e GITHUB_BASE_REF -e GITHUB_EVENT_NAME -e GITHUB_WORKSPACE -e GITHUB_ACTION -e GITHUB_EVENT_PATH -e RUNNER_OS -e RUNNER_TOOL_CACHE -e RUNNER_TEMP -e RUNNER_WORKSPACE -e ACTIONS_RUNTIME_URL -e ACTIONS_RUNTIME_TOKEN -e ACTIONS_CACHE_URL -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/pyhf/pyhf":"/github/workspace" be76db:00e9f497df7b42a2802c9c7aa61823ab
Push to branch master
remote: error: GH006: Protected branch update failed for refs/heads/master.        
remote: error: 18 of 18 required status checks are expected. At least 2 approving reviews are required by reviewers with write access.        
To https://github.com/scikit-hep/pyhf.git
 * [new tag]         v0.4.2 -> v0.4.2
 ! [remote rejected] HEAD -> master (protected branch hook declined)
error: failed to push some refs to '***github.com/scikit-hep/pyhf.git'

by setting the checkout GitHub Action's persist-credentials input to false. The motivations for this are covered in ad-m/github-push-action Issue 44 and ad-m/github-push-action PR 46.

Checklist Before Requesting Reviewer

• Tests are passing
• "WIP" removed from the title of the pull request
• Selected an Assignee for the PR to be responsible for the log summary

Before Merging

For the PR Assignees:

• Summarize commit messages into a comprehensive review of the PR

* Update github-push-action to v0.6.0
* Use 'persist-credentials: false' to allow github-push-action to push to master with a personal access token
   - https://github.com/ad-m/github-push-action/issues/44
   - https://github.com/ad-m/github-push-action/pull/46

[codecov]

Codecov Report

Merging #884 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #884   +/-   ##
=======================================
  Coverage   96.28%   96.28%           
=======================================
  Files          56       56           
  Lines        3179     3179           
  Branches      438      438           
=======================================
  Hits         3061     3061           
  Misses         75       75           
  Partials       43       43           

Flag	Coverage Δ
#unittests	96.28% <ø> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 02e9543...c47ab8c. Read the comment docs.

[matthewfeickert]

@andrzejnovak This is probably of interest to you as well for mplhep.

[github-actions]

I've queued this up. When it gets merged, I'll create a patch release from v0.4.2 → v0.4.3 which includes the following 4 change(s) [including this PR]:

fix: Set checkout GHA persist-credentials to false for push to succeed

feat: Add Patchset/Patch classes and Patchset CLI

fix: Avoid warning of 'app.add_stylesheet() is deprecated'

docs: Add simple examples for inspect, cls, and digest CLI

If you make any more changes, you probably want to re-trigger me again by removing the bumpversion/patch label and then adding it back again.

[github-actions]

😢 Something went wrong. I am not able to push. Check the Actions pipeline to see what happened. If you make any more changes, you probably want to re-trigger me again by adding the bumpversion/patch label again.