From 755ea5c2f6407dcda406d433d34791924dc8d76e Mon Sep 17 00:00:00 2001
From: Derrick Williams <derrickaw@google.com>
Date: Thu, 25 Jun 2026 01:21:58 +0000
Subject: [PATCH 1/3] Initial zizmor findings

---
 .../IO_Iceberg_Integration_Tests.yml          |   4 +-
 .../IO_Iceberg_Integration_Tests_Dataflow.yml |   4 +-
 ...erg_Managed_Integration_Tests_Dataflow.yml |   4 +-
 .../IO_Iceberg_Performance_Tests.yml          |   4 +-
 .github/workflows/IO_Iceberg_Unit_Tests.yml   |   2 +
 .github/workflows/assign_milestone.yml        |   1 +
 .../beam_CancelStaleDataflowJobs.yml          |   2 +
 .../beam_CleanUpDataprocResources.yml         |   4 +-
 .../workflows/beam_CleanUpGCPResources.yml    |   2 +
 .../beam_CleanUpPrebuiltSDKImages.yml         |   4 +-
 .../beam_CloudML_Benchmarks_Dataflow.yml      |   2 +
 .../beam_IODatastoresCredentialsRotation.yml  |   2 +
 ...m_Inference_Python_Benchmarks_Dataflow.yml |   4 +-
 .../beam_Infrastructure_PolicyEnforcer.yml    |   2 +
 .../beam_Infrastructure_SecurityLogging.yml   |   2 +
 ...beam_Infrastructure_ServiceAccountKeys.yml |   2 +
 .../beam_Infrastructure_UsersPermissions.yml  |   1 +
 .github/workflows/beam_Java_JMH.yml           |   4 +-
 .../beam_Java_LoadTests_Combine_Smoke.yml     |   4 +-
 ...beam_LoadTests_Go_CoGBK_Dataflow_Batch.yml |   4 +-
 .../beam_LoadTests_Go_CoGBK_Flink_batch.yml   |   2 +
 ...am_LoadTests_Go_Combine_Dataflow_Batch.yml |   4 +-
 .../beam_LoadTests_Go_Combine_Flink_Batch.yml |   2 +
 .../beam_LoadTests_Go_GBK_Dataflow_Batch.yml  |   4 +-
 .../beam_LoadTests_Go_GBK_Flink_Batch.yml     |   2 +
 ...beam_LoadTests_Go_ParDo_Dataflow_Batch.yml |   4 +-
 .../beam_LoadTests_Go_ParDo_Flink_Batch.yml   |   2 +
 ..._LoadTests_Go_SideInput_Dataflow_Batch.yml |   4 +-
 ...eam_LoadTests_Go_SideInput_Flink_Batch.yml |   2 +
 ...am_LoadTests_Java_CoGBK_Dataflow_Batch.yml |   4 +-
 ...oadTests_Java_CoGBK_Dataflow_Streaming.yml |   4 +-
 ...a_CoGBK_Dataflow_V2_Batch_JavaVersions.yml |   4 +-
 ...GBK_Dataflow_V2_Streaming_JavaVersions.yml |   4 +-
 ...a_CoGBK_SparkStructuredStreaming_Batch.yml |   4 +-
 ..._LoadTests_Java_Combine_Dataflow_Batch.yml |   4 +-
 ...dTests_Java_Combine_Dataflow_Streaming.yml |   4 +-
 ...Combine_SparkStructuredStreaming_Batch.yml |   4 +-
 ...beam_LoadTests_Java_GBK_Dataflow_Batch.yml |   4 +-
 ..._LoadTests_Java_GBK_Dataflow_Streaming.yml |   4 +-
 ...m_LoadTests_Java_GBK_Dataflow_V2_Batch.yml |   4 +-
 ...ests_Java_GBK_Dataflow_V2_Batch_Java17.yml |   4 +-
 ...adTests_Java_GBK_Dataflow_V2_Streaming.yml |   4 +-
 ..._Java_GBK_Dataflow_V2_Streaming_Java17.yml |   4 +-
 .../beam_LoadTests_Java_GBK_Smoke.yml         |   2 +
 ...ava_GBK_SparkStructuredStreaming_Batch.yml |   4 +-
 ...am_LoadTests_Java_ParDo_Dataflow_Batch.yml |   4 +-
 ...oadTests_Java_ParDo_Dataflow_Streaming.yml |   4 +-
 ...a_ParDo_Dataflow_V2_Batch_JavaVersions.yml |   4 +-
 ...rDo_Dataflow_V2_Streaming_JavaVersions.yml |   4 +-
 ...a_ParDo_SparkStructuredStreaming_Batch.yml |   4 +-
 .../beam_LoadTests_Java_PubsubIO.yml          |   4 +-
 ..._LoadTests_Python_CoGBK_Dataflow_Batch.yml |   4 +-
 ...dTests_Python_CoGBK_Dataflow_Streaming.yml |   4 +-
 ...eam_LoadTests_Python_CoGBK_Flink_Batch.yml |   2 +
 ...oadTests_Python_Combine_Dataflow_Batch.yml |   4 +-
 ...ests_Python_Combine_Dataflow_Streaming.yml |   4 +-
 ...m_LoadTests_Python_Combine_Flink_Batch.yml |   4 +-
 ...adTests_Python_Combine_Flink_Streaming.yml |   2 +
 ...ests_Python_FnApiRunner_Microbenchmark.yml |   4 +-
 ...am_LoadTests_Python_GBK_Dataflow_Batch.yml |   4 +-
 ...oadTests_Python_GBK_Dataflow_Streaming.yml |   4 +-
 .../beam_LoadTests_Python_GBK_Flink_Batch.yml |   4 +-
 ...ts_Python_GBK_reiterate_Dataflow_Batch.yml |   4 +-
 ...ython_GBK_reiterate_Dataflow_Streaming.yml |   2 +
 ..._LoadTests_Python_ParDo_Dataflow_Batch.yml |   4 +-
 ...dTests_Python_ParDo_Dataflow_Streaming.yml |   4 +-
 ...eam_LoadTests_Python_ParDo_Flink_Batch.yml |   4 +-
 ...LoadTests_Python_ParDo_Flink_Streaming.yml |   4 +-
 ...dTests_Python_SideInput_Dataflow_Batch.yml |   4 +-
 .../workflows/beam_LoadTests_Python_Smoke.yml |   4 +-
 .../beam_MetricsCredentialsRotation.yml       |   2 +
 .github/workflows/beam_Metrics_Report.yml     |   2 +
 .../beam_PerformanceTests_AvroIOIT.yml        |   2 +
 .../beam_PerformanceTests_AvroIOIT_HDFS.yml   |   2 +
 ...rmanceTests_BigQueryIO_Batch_Java_Avro.yml |   4 +-
 ...rmanceTests_BigQueryIO_Batch_Java_Json.yml |   4 +-
 ...ormanceTests_BigQueryIO_Streaming_Java.yml |   4 +-
 ...erformanceTests_BiqQueryIO_Read_Python.yml |   4 +-
 ...nceTests_BiqQueryIO_Write_Python_Batch.yml |   4 +-
 .../workflows/beam_PerformanceTests_Cdap.yml  |   2 +
 ...m_PerformanceTests_Compressed_TextIOIT.yml |   4 +-
 ...formanceTests_Compressed_TextIOIT_HDFS.yml |   4 +-
 .../beam_PerformanceTests_HadoopFormat.yml    |   2 +
 .../workflows/beam_PerformanceTests_JDBC.yml  |   4 +-
 .../beam_PerformanceTests_Kafka_IO.yml        |   4 +-
 ...am_PerformanceTests_ManyFiles_TextIOIT.yml |   4 +-
 ...rformanceTests_ManyFiles_TextIOIT_HDFS.yml |   4 +-
 .../beam_PerformanceTests_MongoDBIO_IT.yml    |   2 +
 .../beam_PerformanceTests_ParquetIOIT.yml     |   4 +-
 ...beam_PerformanceTests_ParquetIOIT_HDFS.yml |   4 +-
 ...manceTests_PubsubIOIT_Python_Streaming.yml |   4 +-
 ...formanceTests_SQLBigQueryIO_Batch_Java.yml |   4 +-
 .../beam_PerformanceTests_SingleStoreIO.yml   |   4 +-
 ...ormanceTests_SpannerIO_Read_2GB_Python.yml |   4 +-
 ...Tests_SpannerIO_Write_2GB_Python_Batch.yml |   4 +-
 ...beam_PerformanceTests_SparkReceiver_IO.yml |   2 +
 .../beam_PerformanceTests_TFRecordIOIT.yml    |   4 +-
 ...eam_PerformanceTests_TFRecordIOIT_HDFS.yml |   4 +-
 .../beam_PerformanceTests_TextIOIT.yml        |   4 +-
 .../beam_PerformanceTests_TextIOIT_HDFS.yml   |   4 +-
 .../beam_PerformanceTests_TextIOIT_Python.yml |   4 +-
 ...rmanceTests_WordCountIT_PythonVersions.yml |   4 +-
 .../beam_PerformanceTests_XmlIOIT.yml         |   4 +-
 .../beam_PerformanceTests_XmlIOIT_HDFS.yml    |   4 +-
 ..._PerformanceTests_xlang_KafkaIO_Python.yml |   2 +
 .../workflows/beam_Playground_CI_Nightly.yml  |   4 +-
 .../workflows/beam_Playground_Precommit.yml   |   2 +
 .github/workflows/beam_PostCommit_Go.yml      |   4 +-
 .../beam_PostCommit_Go_Dataflow_ARM.yml       |   2 +
 .../workflows/beam_PostCommit_Go_VR_Flink.yml |   4 +-
 .../workflows/beam_PostCommit_Go_VR_Spark.yml |   4 +-
 .github/workflows/beam_PostCommit_Java.yml    |   4 +-
 .../beam_PostCommit_Java_Avro_Versions.yml    |   4 +-
 ...m_PostCommit_Java_BigQueryEarlyRollout.yml |   2 +
 .../beam_PostCommit_Java_DataflowV1.yml       |   4 +-
 .../beam_PostCommit_Java_DataflowV2.yml       |   4 +-
 ...beam_PostCommit_Java_Examples_Dataflow.yml |   4 +-
 ..._PostCommit_Java_Examples_Dataflow_ARM.yml |   2 +
 ...PostCommit_Java_Examples_Dataflow_Java.yml |   4 +-
 ...m_PostCommit_Java_Examples_Dataflow_V2.yml |   2 +
 ...tCommit_Java_Examples_Dataflow_V2_Java.yml |   4 +-
 .../beam_PostCommit_Java_Examples_Direct.yml  |   4 +-
 .../beam_PostCommit_Java_Examples_Flink.yml   |   2 +
 .../beam_PostCommit_Java_Examples_Spark.yml   |   4 +-
 .../beam_PostCommit_Java_Hadoop_Versions.yml  |   4 +-
 ...m_PostCommit_Java_IO_Performance_Tests.yml |   3 +
 .../beam_PostCommit_Java_InfluxDbIO_IT.yml    |   2 +
 .../beam_PostCommit_Java_Jpms_Dataflow.yml    |   2 +
 ...PostCommit_Java_Jpms_Dataflow_Versions.yml |   2 +
 .../beam_PostCommit_Java_Jpms_Direct.yml      |   2 +
 ...m_PostCommit_Java_Jpms_Direct_Versions.yml |   2 +
 ...beam_PostCommit_Java_Jpms_Flink_Java11.yml |   4 +-
 ...beam_PostCommit_Java_Jpms_Spark_Java11.yml |   4 +-
 .../beam_PostCommit_Java_Nexmark_Dataflow.yml |   4 +-
 ...am_PostCommit_Java_Nexmark_Dataflow_V2.yml |   4 +-
 ...stCommit_Java_Nexmark_Dataflow_V2_Java.yml |   4 +-
 .../beam_PostCommit_Java_Nexmark_Direct.yml   |   4 +-
 .../beam_PostCommit_Java_Nexmark_Flink.yml    |   2 +
 .../beam_PostCommit_Java_Nexmark_Spark.yml    |   4 +-
 .../beam_PostCommit_Java_PVR_Flink_Batch.yml  |   2 +
 ...am_PostCommit_Java_PVR_Flink_Streaming.yml |   2 +
 ...m_PostCommit_Java_PVR_Spark3_Streaming.yml |   4 +-
 .../beam_PostCommit_Java_PVR_Spark4_Batch.yml |   2 +
 ...m_PostCommit_Java_PVR_Spark4_Streaming.yml |   4 +-
 .../beam_PostCommit_Java_PVR_Spark_Batch.yml  |   2 +
 .../beam_PostCommit_Java_SingleStoreIO_IT.yml |   2 +
 .../beam_PostCommit_Java_Tpcds_Dataflow.yml   |   2 +
 .../beam_PostCommit_Java_Tpcds_Flink.yml      |   2 +
 .../beam_PostCommit_Java_Tpcds_Spark.yml      |   2 +
 ...stCommit_Java_ValidatesRunner_Dataflow.yml |   4 +-
 ..._ValidatesRunner_Dataflow_JavaVersions.yml |   4 +-
 ...ava_ValidatesRunner_Dataflow_Streaming.yml |   4 +-
 ...idatesRunner_Dataflow_Streaming_Engine.yml |   2 +
 ...unner_Dataflow_Streaming_TagEncodingV2.yml |   2 +
 ...ommit_Java_ValidatesRunner_Dataflow_V2.yml |   4 +-
 ..._ValidatesRunner_Dataflow_V2_Streaming.yml |   4 +-
 ...PostCommit_Java_ValidatesRunner_Direct.yml |   4 +-
 ...va_ValidatesRunner_Direct_JavaVersions.yml |   4 +-
 ..._PostCommit_Java_ValidatesRunner_Flink.yml |   2 +
 ..._PostCommit_Java_ValidatesRunner_Spark.yml |   4 +-
 ...PostCommit_Java_ValidatesRunner_Spark4.yml |   2 +
 ...lidatesRunner_SparkStructuredStreaming.yml |   4 +-
 ...stCommit_Java_ValidatesRunner_Twister2.yml |   4 +-
 ...am_PostCommit_Java_ValidatesRunner_ULR.yml |   4 +-
 .github/workflows/beam_PostCommit_Javadoc.yml |   4 +-
 .../beam_PostCommit_PortableJar_Flink.yml     |   2 +
 .../beam_PostCommit_PortableJar_Spark.yml     |   4 +-
 .github/workflows/beam_PostCommit_Python.yml  |   2 +
 .../workflows/beam_PostCommit_Python_Arm.yml  |   2 +
 .../beam_PostCommit_Python_Dependency.yml     |   2 +
 ...am_PostCommit_Python_Examples_Dataflow.yml |   2 +
 ...beam_PostCommit_Python_Examples_Direct.yml |   4 +-
 .../beam_PostCommit_Python_Examples_Flink.yml |   2 +
 .../beam_PostCommit_Python_Examples_Spark.yml |   4 +-
 .../beam_PostCommit_Python_MongoDBIO_IT.yml   |   2 +
 .../beam_PostCommit_Python_Nexmark_Direct.yml |   4 +-
 .../beam_PostCommit_Python_Portable_Flink.yml |   2 +
 ...mit_Python_ValidatesContainer_Dataflow.yml |   2 +
 ...on_ValidatesContainer_Dataflow_With_RC.yml |   4 +-
 ...Commit_Python_ValidatesRunner_Dataflow.yml |   4 +-
 ...ostCommit_Python_ValidatesRunner_Flink.yml |   4 +-
 ...ostCommit_Python_ValidatesRunner_Spark.yml |   4 +-
 .../beam_PostCommit_Python_Versions.yml       |   2 +
 ...m_PostCommit_Python_Xlang_Gcp_Dataflow.yml |   2 +
 ...eam_PostCommit_Python_Xlang_Gcp_Direct.yml |   2 +
 ...am_PostCommit_Python_Xlang_IO_Dataflow.yml |   2 +
 ...beam_PostCommit_Python_Xlang_IO_Direct.yml |   4 +-
 ...stCommit_Python_Xlang_Messaging_Direct.yml |   2 +
 .github/workflows/beam_PostCommit_SQL.yml     |   2 +
 ...eam_PostCommit_TransformService_Direct.yml |   2 +
 .../beam_PostCommit_Website_Test.yml          |   4 +-
 .../workflows/beam_PostCommit_XVR_Direct.yml  |   4 +-
 .../workflows/beam_PostCommit_XVR_Flink.yml   |   2 +
 ...am_PostCommit_XVR_GoUsingJava_Dataflow.yml |   2 +
 ...ostCommit_XVR_JavaUsingPython_Dataflow.yml |   4 +-
 ...Commit_XVR_PythonUsingJavaSQL_Dataflow.yml |   2 +
 ...ostCommit_XVR_PythonUsingJava_Dataflow.yml |   2 +
 .../workflows/beam_PostCommit_XVR_Spark3.yml  |   4 +-
 .../beam_PostCommit_Yaml_Xlang_Direct.yml     |   2 +
 .../beam_PostRelease_NightlySnapshot.yml      |   6 +-
 .../beam_PreCommit_CommunityMetrics.yml       |   4 +-
 .../beam_PreCommit_Flink_Container.yml        |   4 +-
 .github/workflows/beam_PreCommit_GHA.yml      |   4 +-
 .github/workflows/beam_PreCommit_Go.yml       |   4 +-
 .../workflows/beam_PreCommit_GoPortable.yml   |   2 +
 .github/workflows/beam_PreCommit_GoPrism.yml  |   4 +-
 .../workflows/beam_PreCommit_ItFramework.yml  |   4 +-
 .github/workflows/beam_PreCommit_Java.yml     |   2 +
 ...it_Java_Amazon-Web-Services2_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Amqp_IO_Direct.yml    |   4 +-
 .../beam_PreCommit_Java_Azure_IO_Direct.yml   |   4 +-
 ...eam_PreCommit_Java_Cassandra_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Cdap_IO_Direct.yml    |   4 +-
 ...am_PreCommit_Java_Clickhouse_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Csv_IO_Direct.yml     |   4 +-
 .../beam_PreCommit_Java_Datadog_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Dataflow.yml          |   4 +-
 ...beam_PreCommit_Java_Debezium_IO_Direct.yml |   2 +
 .../beam_PreCommit_Java_Delta_IO_Direct.yml   |   2 +
 ...PreCommit_Java_ElasticSearch_IO_Direct.yml |   2 +
 .../beam_PreCommit_Java_Examples_Dataflow.yml |   4 +-
 ...reCommit_Java_Examples_Dataflow_Java21.yml |   4 +-
 ...t_Java_File-schema-transform_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Flink_Versions.yml    |   4 +-
 .../beam_PreCommit_Java_GCP_IO_Direct.yml     |   4 +-
 ...am_PreCommit_Java_Google-ads_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_HBase_IO_Direct.yml   |   4 +-
 ...beam_PreCommit_Java_HCatalog_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Hadoop_IO_Direct.yml  |   4 +-
 .../beam_PreCommit_Java_IOs_Direct.yml        |   4 +-
 ...beam_PreCommit_Java_InfluxDb_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_JDBC_IO_Direct.yml    |   4 +-
 .../beam_PreCommit_Java_Jms_IO_Direct.yml     |   4 +-
 .../beam_PreCommit_Java_Kafka_IO_Direct.yml   |   2 +
 .../beam_PreCommit_Java_Kudu_IO_Direct.yml    |   4 +-
 .../beam_PreCommit_Java_MongoDb_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Mqtt_IO_Direct.yml    |   4 +-
 .../beam_PreCommit_Java_Neo4j_IO_Direct.yml   |   4 +-
 .../beam_PreCommit_Java_PVR_Flink_Batch.yml   |   2 +
 .../beam_PreCommit_Java_PVR_Flink_Docker.yml  |   2 +
 ...beam_PreCommit_Java_PVR_Prism_Loopback.yml |   2 +
 .../beam_PreCommit_Java_Parquet_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Pulsar_IO_Direct.yml  |   2 +
 ...beam_PreCommit_Java_RabbitMq_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Redis_IO_Direct.yml   |   4 +-
 ...eCommit_Java_RequestResponse_IO_Direct.yml |   4 +-
 ...m_PreCommit_Java_SingleStore_IO_Direct.yml |   4 +-
 ...eam_PreCommit_Java_Snowflake_IO_Direct.yml |   4 +-
 .../beam_PreCommit_Java_Solace_IO_Direct.yml  |   4 +-
 .../beam_PreCommit_Java_Solr_IO_Direct.yml    |   4 +-
 .../beam_PreCommit_Java_Spark_Versions.yml    |   4 +-
 .../beam_PreCommit_Java_Splunk_IO_Direct.yml  |   4 +-
 .../beam_PreCommit_Java_Thrift_IO_Direct.yml  |   4 +-
 .../beam_PreCommit_Java_Tika_IO_Direct.yml    |   4 +-
 .../beam_PreCommit_Kotlin_Examples.yml        |   4 +-
 .../beam_PreCommit_Portable_Python.yml        |   4 +-
 .../workflows/beam_PreCommit_Prism_Python.yml |   4 +-
 .github/workflows/beam_PreCommit_Python.yml   |   2 +
 .../workflows/beam_PreCommit_PythonDocker.yml |   2 +
 .../workflows/beam_PreCommit_PythonDocs.yml   |   2 +
 .../beam_PreCommit_PythonFormatter.yml        |   2 +
 .../workflows/beam_PreCommit_PythonLint.yml   |   2 +
 .../beam_PreCommit_Python_Coverage.yml        |   2 +
 .../beam_PreCommit_Python_Dataframes.yml      |   4 +-
 .../workflows/beam_PreCommit_Python_Dill.yml  |   2 +
 .../beam_PreCommit_Python_Examples.yml        |   2 +
 .../beam_PreCommit_Python_Integration.yml     |   4 +-
 .../workflows/beam_PreCommit_Python_ML.yml    |   2 +
 .../beam_PreCommit_Python_PVR_Flink.yml       |   2 +
 .../beam_PreCommit_Python_Runners.yml         |   4 +-
 .../beam_PreCommit_Python_Transforms.yml      |   2 +
 .github/workflows/beam_PreCommit_RAT.yml      |   2 +
 .github/workflows/beam_PreCommit_SQL.yml      |   4 +-
 .../workflows/beam_PreCommit_SQL_Java17.yml   |   4 +-
 .github/workflows/beam_PreCommit_Spotless.yml |   4 +-
 .../workflows/beam_PreCommit_Typescript.yml   |   4 +-
 .github/workflows/beam_PreCommit_Website.yml  |   4 +-
 .../beam_PreCommit_Website_Stage_GCS.yml      |   2 +
 .../workflows/beam_PreCommit_Whitespace.yml   |   2 +
 ...m_PreCommit_Xlang_Generated_Transforms.yml |   2 +
 .../beam_PreCommit_Yaml_Xlang_Direct.yml      |   2 +
 .../beam_Prober_CommunityMetrics.yml          |   4 +-
 .../workflows/beam_Publish_BeamMetrics.yml    |   2 +
 .../beam_Publish_Beam_SDK_Snapshots.yml       |   2 +
 .../beam_Publish_Docker_Snapshots.yml         |   2 +
 .../beam_Publish_Python_VLLM_Image.yml        |   2 +
 .github/workflows/beam_Publish_Website.yml    |   4 +
 .../beam_Python_CostBenchmarks_Dataflow.yml   |   4 +-
 ...Python_ValidatesContainer_Dataflow_ARM.yml |   2 +
 .../beam_Release_NightlySnapshot.yml          |   2 +
 .../beam_Release_Python_NightlySnapshot.yml   |   4 +-
 .../beam_StressTests_Java_BigQueryIO.yml      |   4 +-
 .../beam_StressTests_Java_BigTableIO.yml      |   4 +-
 .../beam_StressTests_Java_KafkaIO.yml         |   2 +
 .../beam_StressTests_Java_PubSubIO.yml        |   4 +-
 .../beam_StressTests_Java_SpannerIO.yml       |   4 +-
 .github/workflows/build_release_candidate.yml | 112 ++++++++++++------
 .github/workflows/build_runner_image.yml      |   1 +
 .github/workflows/build_wheels.yml            |  27 +++--
 .../code_completion_plugin_tests.yml          |   2 +
 .github/workflows/codeql.yml                  |   2 +
 .github/workflows/cut_release_branch.yml      |   4 +
 .github/workflows/dask_runner_tests.yml       |   4 +
 .../deploy_release_candidate_pypi.yaml        |  12 +-
 .github/workflows/finalize_release.yml        |  11 +-
 .github/workflows/flaky_test_detection.yml    |   2 +
 .../workflows/git_tag_released_version.yml    |  16 ++-
 .github/workflows/go_tests.yml                |   1 +
 .github/workflows/issue-tagger.yml            |   2 +
 .github/workflows/local_env_tests.yml         |   4 +
 .../workflows/playground_frontend_test.yml    |   2 +
 .github/workflows/pr-bot-new-prs.yml          |   2 +
 .github/workflows/pr-bot-pr-updates.yml       |   1 +
 .../pr-bot-prs-needing-attention.yml          |   4 +-
 .../publish_github_release_notes.yml          |  12 +-
 .github/workflows/python_dependency_tests.yml |   2 +
 .github/workflows/python_tests.yml            |   8 ++
 .github/workflows/refresh_looker_metrics.yml  |   2 +
 .github/workflows/reportGenerator.yml         |   2 +
 .../republish_released_docker_containers.yml  |   3 +-
 .github/workflows/run_perf_alert_tool.yml     |   2 +
 .../run_rc_validation_go_wordcount.yml        |   2 +
 .../run_rc_validation_java_mobile_gaming.yml  |  21 ++--
 .../run_rc_validation_java_quickstart.yml     |   1 +
 ...run_rc_validation_python_mobile_gaming.yml |  73 ++++++------
 .../run_rc_validation_python_yaml.yml         |  31 ++---
 .github/workflows/tour_of_beam_backend.yml    |   3 +
 .../tour_of_beam_backend_integration.yml      |   2 +
 .../workflows/tour_of_beam_frontend_test.yml  |   2 +
 .github/workflows/typescript_tests.yml        |   2 +
 .../workflows/update_python_dependencies.yml  |   4 +
 331 files changed, 1043 insertions(+), 309 deletions(-)

diff --git a/.github/workflows/IO_Iceberg_Integration_Tests.yml b/.github/workflows/IO_Iceberg_Integration_Tests.yml
index f0daaf7966df..8780bfee5b3a 100644
--- a/.github/workflows/IO_Iceberg_Integration_Tests.yml
+++ b/.github/workflows/IO_Iceberg_Integration_Tests.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Integration Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Integration Test
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:integrationTest --info
\ No newline at end of file
+          gradle-command: :sdks:java:io:iceberg:integrationTest --info
diff --git a/.github/workflows/IO_Iceberg_Integration_Tests_Dataflow.yml b/.github/workflows/IO_Iceberg_Integration_Tests_Dataflow.yml
index e0bb9a06f2d5..3ec2845d7704 100644
--- a/.github/workflows/IO_Iceberg_Integration_Tests_Dataflow.yml
+++ b/.github/workflows/IO_Iceberg_Integration_Tests_Dataflow.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Integration Tests on Dataflow"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Integration Tests on Dataflow
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest --info
\ No newline at end of file
+          gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest --info
diff --git a/.github/workflows/IO_Iceberg_Managed_Integration_Tests_Dataflow.yml b/.github/workflows/IO_Iceberg_Managed_Integration_Tests_Dataflow.yml
index 60aa67a7081f..4cf38c3ff3fd 100644
--- a/.github/workflows/IO_Iceberg_Managed_Integration_Tests_Dataflow.yml
+++ b/.github/workflows/IO_Iceberg_Managed_Integration_Tests_Dataflow.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Managed Integration Tests on Dataflow"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -78,4 +80,4 @@ jobs:
           gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest
           arguments: |
             --info \
-            -PenableManagedTransforms
\ No newline at end of file
+            -PenableManagedTransforms
diff --git a/.github/workflows/IO_Iceberg_Performance_Tests.yml b/.github/workflows/IO_Iceberg_Performance_Tests.yml
index f35923193937..3cb9c24c26b6 100644
--- a/.github/workflows/IO_Iceberg_Performance_Tests.yml
+++ b/.github/workflows/IO_Iceberg_Performance_Tests.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Performance Test
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:loadTest
\ No newline at end of file
+          gradle-command: :sdks:java:io:iceberg:loadTest
diff --git a/.github/workflows/IO_Iceberg_Unit_Tests.yml b/.github/workflows/IO_Iceberg_Unit_Tests.yml
index 6df57f1399a3..f3fd63a9d479 100644
--- a/.github/workflows/IO_Iceberg_Unit_Tests.yml
+++ b/.github/workflows/IO_Iceberg_Unit_Tests.yml
@@ -83,6 +83,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/assign_milestone.yml b/.github/workflows/assign_milestone.yml
index 3cc35ba342d2..9cb72d4c13dd 100644
--- a/.github/workflows/assign_milestone.yml
+++ b/.github/workflows/assign_milestone.yml
@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - uses: actions/github-script@v9
         with:
diff --git a/.github/workflows/beam_CancelStaleDataflowJobs.yml b/.github/workflows/beam_CancelStaleDataflowJobs.yml
index 62659a7b4238..24a8219b1d5b 100644
--- a/.github/workflows/beam_CancelStaleDataflowJobs.yml
+++ b/.github/workflows/beam_CancelStaleDataflowJobs.yml
@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Cancel Stale Dataflow Jobs'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_CleanUpDataprocResources.yml b/.github/workflows/beam_CleanUpDataprocResources.yml
index 57ce2229fbbe..c7004b1251cf 100644
--- a/.github/workflows/beam_CleanUpDataprocResources.yml
+++ b/.github/workflows/beam_CleanUpDataprocResources.yml
@@ -56,6 +56,8 @@ jobs:
     name: "beam_CleanUpDataprocResources"
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Delete leaked resources for all the jobs that generates flink clusters
         run: |
-          cd ${{ github.workspace }}/.test-infra/dataproc; ./cleanup.sh -xe
\ No newline at end of file
+          cd ${{ github.workspace }}/.test-infra/dataproc; ./cleanup.sh -xe
diff --git a/.github/workflows/beam_CleanUpGCPResources.yml b/.github/workflows/beam_CleanUpGCPResources.yml
index 480e48c1c210..fccdc666a390 100644
--- a/.github/workflows/beam_CleanUpGCPResources.yml
+++ b/.github/workflows/beam_CleanUpGCPResources.yml
@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Clean GCP Resources'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_CleanUpPrebuiltSDKImages.yml b/.github/workflows/beam_CleanUpPrebuiltSDKImages.yml
index b2a686fb6e9b..09f1941de838 100644
--- a/.github/workflows/beam_CleanUpPrebuiltSDKImages.yml
+++ b/.github/workflows/beam_CleanUpPrebuiltSDKImages.yml
@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Clean Prebuilt Images'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -80,4 +82,4 @@ jobs:
       - name: run remove stale sdk container images
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :beam-test-tools:removeStaleSDKContainerImages
\ No newline at end of file
+          gradle-command: :beam-test-tools:removeStaleSDKContainerImages
diff --git a/.github/workflows/beam_CloudML_Benchmarks_Dataflow.yml b/.github/workflows/beam_CloudML_Benchmarks_Dataflow.yml
index 85ba3f01e47c..1a7747cfc2f3 100644
--- a/.github/workflows/beam_CloudML_Benchmarks_Dataflow.yml
+++ b/.github/workflows/beam_CloudML_Benchmarks_Dataflow.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run TFT Criteo Benchmarks"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_IODatastoresCredentialsRotation.yml b/.github/workflows/beam_IODatastoresCredentialsRotation.yml
index fdb570c4b61a..68bf18fd371c 100644
--- a/.github/workflows/beam_IODatastoresCredentialsRotation.yml
+++ b/.github/workflows/beam_IODatastoresCredentialsRotation.yml
@@ -60,6 +60,8 @@ jobs:
         job_phrase: ["N/A"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_Inference_Python_Benchmarks_Dataflow.yml b/.github/workflows/beam_Inference_Python_Benchmarks_Dataflow.yml
index 6bda0379bc7d..26939abb9304 100644
--- a/.github/workflows/beam_Inference_Python_Benchmarks_Dataflow.yml
+++ b/.github/workflows/beam_Inference_Python_Benchmarks_Dataflow.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Inference Benchmarks"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -238,4 +240,4 @@ jobs:
             -PpythonVersion=3.10 \
             -PbeamPythonExtra=ml_test \
             -PloadTest.requirementsTxtFile=apache_beam/ml/transforms/mltransform_tests_requirements.txt \
-            '-PloadTest.args=${{ env.beam_Inference_Python_Benchmarks_Dataflow_test_arguments_12 }} --autoscaling_algorithm=NONE --metrics_table=mltransform_one_hot_encoding_batch --influx_measurement=mltransform_one_hot_encoding_batch --job_name=benchmark-tests-mltransform-one-hot-encoding-batch-${{env.NOW_UTC}} --output_file=gs://temp-storage-for-end-to-end-tests/mltransform/one_hot_output_${{env.NOW_UTC}} --artifact_location=gs://temp-storage-for-end-to-end-tests/mltransform/artifacts_${{env.NOW_UTC}}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_Inference_Python_Benchmarks_Dataflow_test_arguments_12 }} --autoscaling_algorithm=NONE --metrics_table=mltransform_one_hot_encoding_batch --influx_measurement=mltransform_one_hot_encoding_batch --job_name=benchmark-tests-mltransform-one-hot-encoding-batch-${{env.NOW_UTC}} --output_file=gs://temp-storage-for-end-to-end-tests/mltransform/one_hot_output_${{env.NOW_UTC}} --artifact_location=gs://temp-storage-for-end-to-end-tests/mltransform/artifacts_${{env.NOW_UTC}}'
diff --git a/.github/workflows/beam_Infrastructure_PolicyEnforcer.yml b/.github/workflows/beam_Infrastructure_PolicyEnforcer.yml
index cfef684c6f9f..6b0a955ced5b 100644
--- a/.github/workflows/beam_Infrastructure_PolicyEnforcer.yml
+++ b/.github/workflows/beam_Infrastructure_PolicyEnforcer.yml
@@ -43,6 +43,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       
       - name: Setup Python
         uses: actions/setup-python@v4
diff --git a/.github/workflows/beam_Infrastructure_SecurityLogging.yml b/.github/workflows/beam_Infrastructure_SecurityLogging.yml
index 0af0cc81dffc..45f299d5da9f 100644
--- a/.github/workflows/beam_Infrastructure_SecurityLogging.yml
+++ b/.github/workflows/beam_Infrastructure_SecurityLogging.yml
@@ -45,6 +45,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@v4
diff --git a/.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml b/.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml
index 918116232b49..3faa7dc4dea7 100644
--- a/.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml
+++ b/.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml
@@ -49,6 +49,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup gcloud
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
 
diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml
index 12d78b1925c3..0e806034b5ca 100644
--- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml
+++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml
@@ -48,6 +48,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.merged == true && github.base_ref || github.event.pull_request.head.sha }}
+          persist-credentials: false
       - name: Setup gcloud
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: Install Terraform
diff --git a/.github/workflows/beam_Java_JMH.yml b/.github/workflows/beam_Java_JMH.yml
index e2d88a89b40d..cd20a3c9e1ed 100644
--- a/.github/workflows/beam_Java_JMH.yml
+++ b/.github/workflows/beam_Java_JMH.yml
@@ -63,6 +63,8 @@ jobs:
     name: "beam_Java_JMH"
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
       - name: run the Java JMH micro-benchmark harness suite
@@ -72,4 +74,4 @@ jobs:
       - name: run the Java JMH micro-benchmark core suite
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:core:jmh:jmh
\ No newline at end of file
+          gradle-command: :sdks:java:core:jmh:jmh
diff --git a/.github/workflows/beam_Java_LoadTests_Combine_Smoke.yml b/.github/workflows/beam_Java_LoadTests_Combine_Smoke.yml
index 7fb9abb9a599..c62264966832 100644
--- a/.github/workflows/beam_Java_LoadTests_Combine_Smoke.yml
+++ b/.github/workflows/beam_Java_LoadTests_Combine_Smoke.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java Load Tests Combine Smoke"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -104,4 +106,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CombineLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_Java_LoadTests_Combine_Smoke_test_arguments_3 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_Java_LoadTests_Combine_Smoke_test_arguments_3 }}'
diff --git a/.github/workflows/beam_LoadTests_Go_CoGBK_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Go_CoGBK_Dataflow_Batch.yml
index 0ec35e14536e..c55cee5267c7 100644
--- a/.github/workflows/beam_LoadTests_Go_CoGBK_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_CoGBK_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go CoGBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -114,4 +116,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=cogbk \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_CoGBK_Dataflow_Batch_test_arguments_4 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_CoGBK_Dataflow_Batch_test_arguments_4 }}'
diff --git a/.github/workflows/beam_LoadTests_Go_CoGBK_Flink_batch.yml b/.github/workflows/beam_LoadTests_Go_CoGBK_Flink_batch.yml
index 75cdee0a5e87..90efbf7fea7b 100644
--- a/.github/workflows/beam_LoadTests_Go_CoGBK_Flink_batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_CoGBK_Flink_batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go CoGBK Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Go_Combine_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Go_Combine_Dataflow_Batch.yml
index 49e9a51d8967..ff215c901d61 100644
--- a/.github/workflows/beam_LoadTests_Go_Combine_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_Combine_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go Combine Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -106,4 +108,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=combine \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_Combine_Dataflow_Batch_test_arguments_3 }} --job_name=load-tests-go-dataflow-batch-combine-3-${{env.NOW_UTC}}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_Combine_Dataflow_Batch_test_arguments_3 }} --job_name=load-tests-go-dataflow-batch-combine-3-${{env.NOW_UTC}}'
diff --git a/.github/workflows/beam_LoadTests_Go_Combine_Flink_Batch.yml b/.github/workflows/beam_LoadTests_Go_Combine_Flink_Batch.yml
index 4e023f141da6..033ec83ee9b7 100644
--- a/.github/workflows/beam_LoadTests_Go_Combine_Flink_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_Combine_Flink_Batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go Combine Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Go_GBK_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Go_GBK_Dataflow_Batch.yml
index c346e4ef1139..c52389e84fd2 100644
--- a/.github/workflows/beam_LoadTests_Go_GBK_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_GBK_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go GBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -142,4 +144,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=group_by_key \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_GBK_Dataflow_Batch_test_arguments_7 }} --job_name=load-tests-go-dataflow-batch-gbk-7-${{env.NOW_UTC}}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_GBK_Dataflow_Batch_test_arguments_7 }} --job_name=load-tests-go-dataflow-batch-gbk-7-${{env.NOW_UTC}}'
diff --git a/.github/workflows/beam_LoadTests_Go_GBK_Flink_Batch.yml b/.github/workflows/beam_LoadTests_Go_GBK_Flink_Batch.yml
index 4d7b955c2ad2..dddb3348acdf 100644
--- a/.github/workflows/beam_LoadTests_Go_GBK_Flink_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_GBK_Flink_Batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go GBK Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Go_ParDo_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Go_ParDo_Dataflow_Batch.yml
index 4cfd1a8b21bf..f8643238e4e9 100644
--- a/.github/workflows/beam_LoadTests_Go_ParDo_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_ParDo_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go ParDo Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -114,4 +116,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=pardo \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_ParDo_Dataflow_Batch_test_arguments_4 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_ParDo_Dataflow_Batch_test_arguments_4 }}'
diff --git a/.github/workflows/beam_LoadTests_Go_ParDo_Flink_Batch.yml b/.github/workflows/beam_LoadTests_Go_ParDo_Flink_Batch.yml
index 745432a4a296..f514b5e88d09 100644
--- a/.github/workflows/beam_LoadTests_Go_ParDo_Flink_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_ParDo_Flink_Batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go ParDo Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Go_SideInput_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Go_SideInput_Dataflow_Batch.yml
index ccb73f51f9f5..59bf9bd952b8 100644
--- a/.github/workflows/beam_LoadTests_Go_SideInput_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_SideInput_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go SideInput Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -96,4 +98,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=sideinput \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_SideInput_Dataflow_Batch_test_arguments_2 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_SideInput_Dataflow_Batch_test_arguments_2 }}'
diff --git a/.github/workflows/beam_LoadTests_Go_SideInput_Flink_Batch.yml b/.github/workflows/beam_LoadTests_Go_SideInput_Flink_Batch.yml
index 21109c0c89f2..8dadc6f68a7f 100644
--- a/.github/workflows/beam_LoadTests_Go_SideInput_Flink_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Go_SideInput_Flink_Batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go SideInput Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Batch.yml
index d0ae3d337a4f..2be67a5098a6 100644
--- a/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java CoGBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -113,4 +115,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CoGroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_Batch_test_arguments_4 }} --appName=load_tests_Java_Dataflow_batch_CoGBK_4'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_Batch_test_arguments_4 }} --appName=load_tests_Java_Dataflow_batch_CoGBK_4'
diff --git a/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml
index ccb77b6fcb8b..cd4e3c440242 100644
--- a/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java CoGBK Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -125,4 +127,4 @@ jobs:
         if: always()
         with:
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions.yml b/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions.yml
index c7798c6267f3..5766d13483f4 100644
--- a/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions.yml
+++ b/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions.yml
@@ -67,6 +67,8 @@ jobs:
         java_version: ['11','17']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -129,4 +131,4 @@ jobs:
             -Pjava${{ matrix.java_version }}Home=$JAVA_HOME_${{ matrix.java_version }}_X64 \
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CoGroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_batch_CoGBK_4'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_batch_CoGBK_4'
diff --git a/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Streaming_JavaVersions.yml b/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Streaming_JavaVersions.yml
index e20c26dbcd2e..597d3c8c9bd6 100644
--- a/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Streaming_JavaVersions.yml
+++ b/.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Streaming_JavaVersions.yml
@@ -67,6 +67,8 @@ jobs:
         java_version: ['11','17']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -129,4 +131,4 @@ jobs:
             -Pjava${{ matrix.java_version }}Home=$JAVA_HOME_${{ matrix.java_version }}_X64 \
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CoGroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_V2_Streaming_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_streaming_CoGBK_4'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_V2_Streaming_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_streaming_CoGBK_4'
diff --git a/.github/workflows/beam_LoadTests_Java_CoGBK_SparkStructuredStreaming_Batch.yml b/.github/workflows/beam_LoadTests_Java_CoGBK_SparkStructuredStreaming_Batch.yml
index 9769622b2cde..026bb08d098c 100644
--- a/.github/workflows/beam_LoadTests_Java_CoGBK_SparkStructuredStreaming_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_CoGBK_SparkStructuredStreaming_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java CoGBK SparkStructuredStreaming Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -113,4 +115,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CoGroupByKeyLoadTest \
             -Prunner=:runners:spark:3 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_SparkStructuredStreaming_Batch_test_arguments_4 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_SparkStructuredStreaming_Batch_test_arguments_4 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_Combine_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Java_Combine_Dataflow_Batch.yml
index e1169fdeb2f9..0267d77c8afa 100644
--- a/.github/workflows/beam_LoadTests_Java_Combine_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_Combine_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java Combine Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -103,4 +105,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CombineLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_Combine_Dataflow_Batch_test_arguments_3 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_Combine_Dataflow_Batch_test_arguments_3 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_Combine_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Java_Combine_Dataflow_Streaming.yml
index c2c6c3ab80bd..5107db698609 100644
--- a/.github/workflows/beam_LoadTests_Java_Combine_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Java_Combine_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java Combine Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -104,4 +106,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CombineLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_Combine_Dataflow_Streaming_test_arguments_3 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_Combine_Dataflow_Streaming_test_arguments_3 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_Combine_SparkStructuredStreaming_Batch.yml b/.github/workflows/beam_LoadTests_Java_Combine_SparkStructuredStreaming_Batch.yml
index 5d4113a35d29..0e422d9b5f90 100644
--- a/.github/workflows/beam_LoadTests_Java_Combine_SparkStructuredStreaming_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_Combine_SparkStructuredStreaming_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java Combine SparkStructuredStreaming Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -104,4 +106,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CombineLoadTest \
             -Prunner=:runners:spark:3 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_Combine_SparkStructuredStreaming_Batch_test_arguments_3 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_Combine_SparkStructuredStreaming_Batch_test_arguments_3 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_Batch.yml
index 91ad51daf0e0..df6b4c1c8dc2 100644
--- a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java GBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -140,4 +142,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.GroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_Batch_test_arguments_7 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_Batch_test_arguments_7 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_Streaming.yml
index 4295085a4f8a..c4c99566aefb 100644
--- a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java GBK Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -140,4 +142,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.GroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_Streaming_test_arguments_7 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_Streaming_test_arguments_7 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Batch.yml b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Batch.yml
index 6237622e3959..ecfd3f5752d2 100644
--- a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests GBK Dataflow V2 Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -149,4 +151,4 @@ jobs:
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.GroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
             -Prunner.version=V2 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_V2_Batch_test_arguments_7 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_V2_Batch_test_arguments_7 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17.yml b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17.yml
index beb74f56d559..3057bfbd6695 100644
--- a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17.yml
+++ b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java 17 GBK Dataflow V2 Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -165,4 +167,4 @@ jobs:
             -Prunner.version=V2 \
             -PtestJavaVersion=17 \
             -Pjava17Home=$JAVA_HOME_17_X64 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17_test_arguments_7 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17_test_arguments_7 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Streaming.yml b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Streaming.yml
index cb6dc88da539..090d500ee5d6 100644
--- a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests GBK Dataflow V2 Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -149,4 +151,4 @@ jobs:
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.GroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
             -Prunner.version=V2 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_test_arguments_7 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_test_arguments_7 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17.yml b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17.yml
index 8bfe24be9a9d..61fe5eb6d6e6 100644
--- a/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17.yml
+++ b/.github/workflows/beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java 17 GBK Dataflow V2 Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -165,4 +167,4 @@ jobs:
             -Prunner.version=V2 \
             -PtestJavaVersion=17 \
             -Pjava17Home=$JAVA_HOME_17_X64 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17_test_arguments_7 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17_test_arguments_7 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_GBK_Smoke.yml b/.github/workflows/beam_LoadTests_Java_GBK_Smoke.yml
index fc143008eac4..6a26957ef933 100644
--- a/.github/workflows/beam_LoadTests_Java_GBK_Smoke.yml
+++ b/.github/workflows/beam_LoadTests_Java_GBK_Smoke.yml
@@ -60,6 +60,8 @@ jobs:
         job_phrase: ["Run Java Load Tests GBK Smoke"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch.yml b/.github/workflows/beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch.yml
index 40b0af0e8635..4f6eb9d66db7 100644
--- a/.github/workflows/beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java GBK SparkStructuredStreaming Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -140,4 +142,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.GroupByKeyLoadTest \
             -Prunner=:runners:spark:3 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch_test_arguments_7 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch_test_arguments_7 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_Batch.yml
index 411c8fec77ab..6ba3e4b884a1 100644
--- a/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java ParDo Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -113,4 +115,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.ParDoLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_Dataflow_Batch_test_arguments_4 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_Dataflow_Batch_test_arguments_4 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_Streaming.yml
index 0a490623daf5..2ef48d7aaf67 100644
--- a/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java ParDo Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -113,4 +115,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.ParDoLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_Dataflow_Streaming_test_arguments_4 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_Dataflow_Streaming_test_arguments_4 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_V2_Batch_JavaVersions.yml b/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_V2_Batch_JavaVersions.yml
index cc80be262670..bcc43739d938 100644
--- a/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_V2_Batch_JavaVersions.yml
+++ b/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_V2_Batch_JavaVersions.yml
@@ -67,6 +67,8 @@ jobs:
         java_version: ['11','17']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -133,4 +135,4 @@ jobs:
             -Prunner.version=V2 \
             -PtestJavaVersion=${{ matrix.java_version }} \
             -Pjava${{ matrix.java_version }}Home=$JAVA_HOME_${{ matrix.java_version }}_X64 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_Dataflow_V2_Batch_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_batch_ParDo_4'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_Dataflow_V2_Batch_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_batch_ParDo_4'
diff --git a/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_V2_Streaming_JavaVersions.yml b/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_V2_Streaming_JavaVersions.yml
index 848632818c45..15ee079dcad7 100644
--- a/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_V2_Streaming_JavaVersions.yml
+++ b/.github/workflows/beam_LoadTests_Java_ParDo_Dataflow_V2_Streaming_JavaVersions.yml
@@ -67,6 +67,8 @@ jobs:
         java_version: ['11','17']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -133,4 +135,4 @@ jobs:
             -Prunner.version=V2 \
             -PtestJavaVersion=${{ matrix.java_version }} \
             -Pjava${{ matrix.java_version }}Home=$JAVA_HOME_${{ matrix.java_version }}_X64 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_Dataflow_V2_Streaming_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_streaming_ParDo_4'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_Dataflow_V2_Streaming_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_streaming_ParDo_4'
diff --git a/.github/workflows/beam_LoadTests_Java_ParDo_SparkStructuredStreaming_Batch.yml b/.github/workflows/beam_LoadTests_Java_ParDo_SparkStructuredStreaming_Batch.yml
index 20540be6a0d3..95d7bbf46c9f 100644
--- a/.github/workflows/beam_LoadTests_Java_ParDo_SparkStructuredStreaming_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Java_ParDo_SparkStructuredStreaming_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java ParDo SparkStructuredStreaming Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -113,4 +115,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.ParDoLoadTest \
             -Prunner=:runners:spark:3 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_SparkStructuredStreaming_Batch_test_arguments_4 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_ParDo_SparkStructuredStreaming_Batch_test_arguments_4 }}'
diff --git a/.github/workflows/beam_LoadTests_Java_PubsubIO.yml b/.github/workflows/beam_LoadTests_Java_PubsubIO.yml
index 915de7440603..6aa9b0b4982d 100644
--- a/.github/workflows/beam_LoadTests_Java_PubsubIO.yml
+++ b/.github/workflows/beam_LoadTests_Java_PubsubIO.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java PubsubIO"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -74,4 +76,4 @@ jobs:
       - name: run PubSub Performance test
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :it:google-cloud-platform:PubsubLoadTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_load_test_pubsub"
\ No newline at end of file
+          gradle-command: :it:google-cloud-platform:PubsubLoadTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_load_test_pubsub"
diff --git a/.github/workflows/beam_LoadTests_Python_CoGBK_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Python_CoGBK_Dataflow_Batch.yml
index cb12ef2bc4f9..d72781e0b88c 100644
--- a/.github/workflows/beam_LoadTests_Python_CoGBK_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_CoGBK_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python CoGBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -124,4 +126,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.co_group_by_key_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_CoGBK_Dataflow_Batch_test_arguments_4 }} --job_name=load-tests-python-dataflow-batch-cogbk-4-${{ steps.datetime.outputs.datetime }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_CoGBK_Dataflow_Batch_test_arguments_4 }} --job_name=load-tests-python-dataflow-batch-cogbk-4-${{ steps.datetime.outputs.datetime }}'
diff --git a/.github/workflows/beam_LoadTests_Python_CoGBK_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Python_CoGBK_Dataflow_Streaming.yml
index 5f1774a0b6c8..45d75c85a834 100644
--- a/.github/workflows/beam_LoadTests_Python_CoGBK_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Python_CoGBK_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python CoGBK Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -123,4 +125,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.co_group_by_key_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_CoGBK_Dataflow_Streaming_test_arguments_4 }} --job_name=load-tests-python-dataflow-streaming-cogbk-4-${{ steps.datetime.outputs.datetime }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_CoGBK_Dataflow_Streaming_test_arguments_4 }} --job_name=load-tests-python-dataflow-streaming-cogbk-4-${{ steps.datetime.outputs.datetime }}'
diff --git a/.github/workflows/beam_LoadTests_Python_CoGBK_Flink_Batch.yml b/.github/workflows/beam_LoadTests_Python_CoGBK_Flink_Batch.yml
index 646a705eb85d..59672ff178d8 100644
--- a/.github/workflows/beam_LoadTests_Python_CoGBK_Flink_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_CoGBK_Flink_Batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Python CoGBK Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Python_Combine_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Python_Combine_Dataflow_Batch.yml
index 8096fbeb5497..4a2fdfcadc51 100644
--- a/.github/workflows/beam_LoadTests_Python_Combine_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_Combine_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python Combine Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -111,4 +113,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.combine_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_Combine_Dataflow_Batch_test_arguments_3 }} --job_name=load-tests-python-dataflow-batch-combine-3-${{env.NOW_UTC}}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_Combine_Dataflow_Batch_test_arguments_3 }} --job_name=load-tests-python-dataflow-batch-combine-3-${{env.NOW_UTC}}'
diff --git a/.github/workflows/beam_LoadTests_Python_Combine_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Python_Combine_Dataflow_Streaming.yml
index 97682ce161c4..f41d58bf2175 100644
--- a/.github/workflows/beam_LoadTests_Python_Combine_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Python_Combine_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python Combine Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -111,4 +113,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.combine_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_Combine_Dataflow_Streaming_test_arguments_3 }} --job_name=load-tests-python-dataflow-streaming-combine-5-${{env.NOW_UTC}}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_Combine_Dataflow_Streaming_test_arguments_3 }} --job_name=load-tests-python-dataflow-streaming-combine-5-${{env.NOW_UTC}}'
diff --git a/.github/workflows/beam_LoadTests_Python_Combine_Flink_Batch.yml b/.github/workflows/beam_LoadTests_Python_Combine_Flink_Batch.yml
index a72f2566cbba..c6e967875425 100644
--- a/.github/workflows/beam_LoadTests_Python_Combine_Flink_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_Combine_Flink_Batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Python Combine Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -137,4 +139,4 @@ jobs:
       - name: Teardown Flink
         if: always()
         run: |
-          ${{ github.workspace }}/.test-infra/dataproc/flink_cluster.sh delete
\ No newline at end of file
+          ${{ github.workspace }}/.test-infra/dataproc/flink_cluster.sh delete
diff --git a/.github/workflows/beam_LoadTests_Python_Combine_Flink_Streaming.yml b/.github/workflows/beam_LoadTests_Python_Combine_Flink_Streaming.yml
index cb2d45ffffc9..612a2c312446 100644
--- a/.github/workflows/beam_LoadTests_Python_Combine_Flink_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Python_Combine_Flink_Streaming.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Python Combine Flink Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Python_FnApiRunner_Microbenchmark.yml b/.github/workflows/beam_LoadTests_Python_FnApiRunner_Microbenchmark.yml
index b240daab30da..60f8422aed0b 100644
--- a/.github/workflows/beam_LoadTests_Python_FnApiRunner_Microbenchmark.yml
+++ b/.github/workflows/beam_LoadTests_Python_FnApiRunner_Microbenchmark.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Python Load Tests FnApiRunner Microbenchmark"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -88,4 +90,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.microbenchmarks_test \
             -Prunner=DirectRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_FnApiRunner_Microbenchmark_test_arguments_1 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_FnApiRunner_Microbenchmark_test_arguments_1 }}'
diff --git a/.github/workflows/beam_LoadTests_Python_GBK_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Python_GBK_Dataflow_Batch.yml
index 1933569df097..ed63e9650e78 100644
--- a/.github/workflows/beam_LoadTests_Python_GBK_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_GBK_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python GBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -131,4 +133,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.group_by_key_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_GBK_Dataflow_Batch_test_arguments_5 }} --job_name=load-tests-python-dataflow-batch-gbk-5-${{env.NOW_UTC}}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_GBK_Dataflow_Batch_test_arguments_5 }} --job_name=load-tests-python-dataflow-batch-gbk-5-${{env.NOW_UTC}}'
diff --git a/.github/workflows/beam_LoadTests_Python_GBK_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Python_GBK_Dataflow_Streaming.yml
index c9a75e714d34..c553372c9c37 100644
--- a/.github/workflows/beam_LoadTests_Python_GBK_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Python_GBK_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python GBK Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -97,4 +99,4 @@ jobs:
           # load-tests-python-dataflow-streaming-gbk-1
           # load-tests-python-dataflow-streaming-gbk-2
           # load-tests-python-dataflow-streaming-gbk-4
-          # load-tests-python-dataflow-streaming-gbk-5
\ No newline at end of file
+          # load-tests-python-dataflow-streaming-gbk-5
diff --git a/.github/workflows/beam_LoadTests_Python_GBK_Flink_Batch.yml b/.github/workflows/beam_LoadTests_Python_GBK_Flink_Batch.yml
index 2a8163a4a098..85fed31a58a8 100644
--- a/.github/workflows/beam_LoadTests_Python_GBK_Flink_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_GBK_Flink_Batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Python GBK Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -152,4 +154,4 @@ jobs:
         run: |
           ${{ github.workspace }}/.test-infra/dataproc/flink_cluster.sh delete
         
-        # TODO(https://github.com/apache/beam/issues/20146) Re-enable auto builds after these tests pass.
\ No newline at end of file
+        # TODO(https://github.com/apache/beam/issues/20146) Re-enable auto builds after these tests pass.
diff --git a/.github/workflows/beam_LoadTests_Python_GBK_reiterate_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Python_GBK_reiterate_Dataflow_Batch.yml
index 544db35178cd..ce3aeb724281 100644
--- a/.github/workflows/beam_LoadTests_Python_GBK_reiterate_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_GBK_reiterate_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python GBK reiterate Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -101,4 +103,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.group_by_key_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_GBK_reiterate_Dataflow_Batch_test_arguments_2 }} --job_name=load-tests-python-dataflow-batch-gbk-7-${{env.NOW_UTC}}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_GBK_reiterate_Dataflow_Batch_test_arguments_2 }} --job_name=load-tests-python-dataflow-batch-gbk-7-${{env.NOW_UTC}}'
diff --git a/.github/workflows/beam_LoadTests_Python_GBK_reiterate_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Python_GBK_reiterate_Dataflow_Streaming.yml
index fe7d19b8e758..18476e5172fe 100644
--- a/.github/workflows/beam_LoadTests_Python_GBK_reiterate_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Python_GBK_reiterate_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python GBK reiterate Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_LoadTests_Python_ParDo_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Python_ParDo_Dataflow_Batch.yml
index f73ea2c3cf46..e0b5a0a3075b 100644
--- a/.github/workflows/beam_LoadTests_Python_ParDo_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_ParDo_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python ParDo Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -123,4 +125,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.pardo_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_ParDo_Dataflow_Batch_test_arguments_4 }} --job_name=load-tests-python-dataflow-batch-pardo-4-${{ steps.datetime.outputs.datetime }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_ParDo_Dataflow_Batch_test_arguments_4 }} --job_name=load-tests-python-dataflow-batch-pardo-4-${{ steps.datetime.outputs.datetime }}'
diff --git a/.github/workflows/beam_LoadTests_Python_ParDo_Dataflow_Streaming.yml b/.github/workflows/beam_LoadTests_Python_ParDo_Dataflow_Streaming.yml
index ea041470903f..be19a46d381c 100644
--- a/.github/workflows/beam_LoadTests_Python_ParDo_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Python_ParDo_Dataflow_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Python Load Tests ParDo Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -123,4 +125,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.pardo_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_ParDo_Dataflow_Streaming_test_arguments_4 }} --job_name=load-tests-python-dataflow-streaming-pardo-4-${{ steps.datetime.outputs.datetime }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_ParDo_Dataflow_Streaming_test_arguments_4 }} --job_name=load-tests-python-dataflow-streaming-pardo-4-${{ steps.datetime.outputs.datetime }}'
diff --git a/.github/workflows/beam_LoadTests_Python_ParDo_Flink_Batch.yml b/.github/workflows/beam_LoadTests_Python_ParDo_Flink_Batch.yml
index f72ee9e98f2a..e09951159a40 100644
--- a/.github/workflows/beam_LoadTests_Python_ParDo_Flink_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_ParDo_Flink_Batch.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Python ParDo Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -128,4 +130,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.pardo_test \
             -Prunner=PortableRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_ParDo_Flink_Batch_test_arguments_3 }} --job_name=load-tests-python-flink-batch-pardo-4-${{ steps.datetime.outputs.datetime }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_ParDo_Flink_Batch_test_arguments_3 }} --job_name=load-tests-python-flink-batch-pardo-4-${{ steps.datetime.outputs.datetime }}'
diff --git a/.github/workflows/beam_LoadTests_Python_ParDo_Flink_Streaming.yml b/.github/workflows/beam_LoadTests_Python_ParDo_Flink_Streaming.yml
index 345dc43386bc..da4e94ee924e 100644
--- a/.github/workflows/beam_LoadTests_Python_ParDo_Flink_Streaming.yml
+++ b/.github/workflows/beam_LoadTests_Python_ParDo_Flink_Streaming.yml
@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Python ParDo Flink Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -152,4 +154,4 @@ jobs:
       - name: Teardown Flink
         if: always()
         run: |
-          ${{ github.workspace }}/.test-infra/dataproc/flink_cluster.sh delete
\ No newline at end of file
+          ${{ github.workspace }}/.test-infra/dataproc/flink_cluster.sh delete
diff --git a/.github/workflows/beam_LoadTests_Python_SideInput_Dataflow_Batch.yml b/.github/workflows/beam_LoadTests_Python_SideInput_Dataflow_Batch.yml
index 4ca3f7ef0276..143ded560613 100644
--- a/.github/workflows/beam_LoadTests_Python_SideInput_Dataflow_Batch.yml
+++ b/.github/workflows/beam_LoadTests_Python_SideInput_Dataflow_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Python SideInput Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -183,4 +185,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.sideinput_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_SideInput_Dataflow_Batch_test_arguments_10 }} --job_name=load-tests-python-dataflow-batch-sideinput-10-${{ steps.datetime.outputs.datetime }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_SideInput_Dataflow_Batch_test_arguments_10 }} --job_name=load-tests-python-dataflow-batch-sideinput-10-${{ steps.datetime.outputs.datetime }}'
diff --git a/.github/workflows/beam_LoadTests_Python_Smoke.yml b/.github/workflows/beam_LoadTests_Python_Smoke.yml
index 9f70b0e98c57..86638cfd6a85 100644
--- a/.github/workflows/beam_LoadTests_Python_Smoke.yml
+++ b/.github/workflows/beam_LoadTests_Python_Smoke.yml
@@ -60,6 +60,8 @@ jobs:
         job_phrase: ["Run Python Load Tests Smoke"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -100,4 +102,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.testing.load_tests.group_by_key_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_LoadTests_Python_Smoke_test_arguments_2 }} --job_name=load-tests-python-dataflow-batch-gbk-smoke-${{ steps.datetime.outputs.datetime }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_LoadTests_Python_Smoke_test_arguments_2 }} --job_name=load-tests-python-dataflow-batch-gbk-smoke-${{ steps.datetime.outputs.datetime }}'
diff --git a/.github/workflows/beam_MetricsCredentialsRotation.yml b/.github/workflows/beam_MetricsCredentialsRotation.yml
index 4498940783ba..74da6fcc2964 100644
--- a/.github/workflows/beam_MetricsCredentialsRotation.yml
+++ b/.github/workflows/beam_MetricsCredentialsRotation.yml
@@ -60,6 +60,8 @@ jobs:
         job_phrase: ["N/A"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_Metrics_Report.yml b/.github/workflows/beam_Metrics_Report.yml
index 75c2ff4c01cc..6c1ed828ff46 100644
--- a/.github/workflows/beam_Metrics_Report.yml
+++ b/.github/workflows/beam_Metrics_Report.yml
@@ -62,6 +62,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
diff --git a/.github/workflows/beam_PerformanceTests_AvroIOIT.yml b/.github/workflows/beam_PerformanceTests_AvroIOIT.yml
index 7cbffd8e8bf0..3d5816f432db 100644
--- a/.github/workflows/beam_PerformanceTests_AvroIOIT.yml
+++ b/.github/workflows/beam_PerformanceTests_AvroIOIT.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java AvroIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PerformanceTests_AvroIOIT_HDFS.yml b/.github/workflows/beam_PerformanceTests_AvroIOIT_HDFS.yml
index a7ec4307593d..f7e326d744bf 100644
--- a/.github/workflows/beam_PerformanceTests_AvroIOIT_HDFS.yml
+++ b/.github/workflows/beam_PerformanceTests_AvroIOIT_HDFS.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java AvroIO Performance Test HDFS"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PerformanceTests_BigQueryIO_Batch_Java_Avro.yml b/.github/workflows/beam_PerformanceTests_BigQueryIO_Batch_Java_Avro.yml
index 78584e824f27..71b9405c233f 100644
--- a/.github/workflows/beam_PerformanceTests_BigQueryIO_Batch_Java_Avro.yml
+++ b/.github/workflows/beam_PerformanceTests_BigQueryIO_Batch_Java_Avro.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run BigQueryIO Batch Performance Test Java Avro"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -103,4 +105,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PerformanceTests_BigQueryIO_Batch_Java_Json.yml b/.github/workflows/beam_PerformanceTests_BigQueryIO_Batch_Java_Json.yml
index c71d8a7f17ee..53e0d26c2e43 100644
--- a/.github/workflows/beam_PerformanceTests_BigQueryIO_Batch_Java_Json.yml
+++ b/.github/workflows/beam_PerformanceTests_BigQueryIO_Batch_Java_Json.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run BigQueryIO Batch Performance Test Java Json"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -103,4 +105,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PerformanceTests_BigQueryIO_Streaming_Java.yml b/.github/workflows/beam_PerformanceTests_BigQueryIO_Streaming_Java.yml
index 4fe06419e821..690a126635a3 100644
--- a/.github/workflows/beam_PerformanceTests_BigQueryIO_Streaming_Java.yml
+++ b/.github/workflows/beam_PerformanceTests_BigQueryIO_Streaming_Java.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run BigQueryIO Streaming Performance Test Java"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -103,4 +105,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PerformanceTests_BiqQueryIO_Read_Python.yml b/.github/workflows/beam_PerformanceTests_BiqQueryIO_Read_Python.yml
index 97ba3bbd13d4..14ad834b970f 100644
--- a/.github/workflows/beam_PerformanceTests_BiqQueryIO_Read_Python.yml
+++ b/.github/workflows/beam_PerformanceTests_BiqQueryIO_Read_Python.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run BigQueryIO Read Performance Test Python"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.io.gcp.bigquery_read_perf_test \
             -PpythonVersion=3.10 \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{env.beam_PerformanceTests_BiqQueryIO_Read_Python_test_arguments_1}}'
\ No newline at end of file
+            '-PloadTest.args=${{env.beam_PerformanceTests_BiqQueryIO_Read_Python_test_arguments_1}}'
diff --git a/.github/workflows/beam_PerformanceTests_BiqQueryIO_Write_Python_Batch.yml b/.github/workflows/beam_PerformanceTests_BiqQueryIO_Write_Python_Batch.yml
index 298fe697dfda..b157b566784f 100644
--- a/.github/workflows/beam_PerformanceTests_BiqQueryIO_Write_Python_Batch.yml
+++ b/.github/workflows/beam_PerformanceTests_BiqQueryIO_Write_Python_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run BigQueryIO Write Performance Test Python"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.io.gcp.bigquery_write_perf_test \
             -PpythonVersion=3.10 \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{env.beam_PerformanceTests_BiqQueryIO_Write_Python_Batch_test_arguments_1}}'
\ No newline at end of file
+            '-PloadTest.args=${{env.beam_PerformanceTests_BiqQueryIO_Write_Python_Batch_test_arguments_1}}'
diff --git a/.github/workflows/beam_PerformanceTests_Cdap.yml b/.github/workflows/beam_PerformanceTests_Cdap.yml
index 698c7924c23a..36da99d9f42b 100644
--- a/.github/workflows/beam_PerformanceTests_Cdap.yml
+++ b/.github/workflows/beam_PerformanceTests_Cdap.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java CdapIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PerformanceTests_Compressed_TextIOIT.yml b/.github/workflows/beam_PerformanceTests_Compressed_TextIOIT.yml
index 996984f4d085..9dcd9868fbff 100644
--- a/.github/workflows/beam_PerformanceTests_Compressed_TextIOIT.yml
+++ b/.github/workflows/beam_PerformanceTests_Compressed_TextIOIT.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java CompressedTextIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -90,4 +92,4 @@ jobs:
             --info \
             -Dfilesystem=gcs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_Compressed_TextIOIT_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_Compressed_TextIOIT_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_Compressed_TextIOIT_HDFS.yml b/.github/workflows/beam_PerformanceTests_Compressed_TextIOIT_HDFS.yml
index d0b1e0f0bd2b..9343cbc6b478 100644
--- a/.github/workflows/beam_PerformanceTests_Compressed_TextIOIT_HDFS.yml
+++ b/.github/workflows/beam_PerformanceTests_Compressed_TextIOIT_HDFS.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java CompressedTextIO Performance Test HDFS"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
             --info \
             -Dfilesystem=hdfs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_Compressed_TextIOIT_HDFS_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_Compressed_TextIOIT_HDFS_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_HadoopFormat.yml b/.github/workflows/beam_PerformanceTests_HadoopFormat.yml
index 2f93007c8420..7e4ba8d23d36 100644
--- a/.github/workflows/beam_PerformanceTests_HadoopFormat.yml
+++ b/.github/workflows/beam_PerformanceTests_HadoopFormat.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java HadoopFormatIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PerformanceTests_JDBC.yml b/.github/workflows/beam_PerformanceTests_JDBC.yml
index dd5e3752c2d3..5c5e8d2400e2 100644
--- a/.github/workflows/beam_PerformanceTests_JDBC.yml
+++ b/.github/workflows/beam_PerformanceTests_JDBC.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java JdbcIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
             --info \
             -Dfilesystem=hdfs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{env.beam_PerformanceTests_JDBC_test_arguments_1}}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{env.beam_PerformanceTests_JDBC_test_arguments_1}}]'
diff --git a/.github/workflows/beam_PerformanceTests_Kafka_IO.yml b/.github/workflows/beam_PerformanceTests_Kafka_IO.yml
index a90fb2f17228..5434c383fddb 100644
--- a/.github/workflows/beam_PerformanceTests_Kafka_IO.yml
+++ b/.github/workflows/beam_PerformanceTests_Kafka_IO.yml
@@ -65,6 +65,8 @@ jobs:
       KAFKA_SERVICE_PORT: 32400
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -120,4 +122,4 @@ jobs:
             --tests org.apache.beam.sdk.io.kafka.KafkaIOIT.testKafkaIOReadsAndWritesCorrectlyInBatch \
             --info \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{env.beam_PerformanceTests_Kafka_IO_test_arguments_2}}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{env.beam_PerformanceTests_Kafka_IO_test_arguments_2}}]'
diff --git a/.github/workflows/beam_PerformanceTests_ManyFiles_TextIOIT.yml b/.github/workflows/beam_PerformanceTests_ManyFiles_TextIOIT.yml
index f7a932545c22..a41ba911410a 100644
--- a/.github/workflows/beam_PerformanceTests_ManyFiles_TextIOIT.yml
+++ b/.github/workflows/beam_PerformanceTests_ManyFiles_TextIOIT.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java ManyFilesTextIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -90,4 +92,4 @@ jobs:
             --info \
             -Dfilesystem=gcs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_ManyFiles_TextIOIT_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_ManyFiles_TextIOIT_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_ManyFiles_TextIOIT_HDFS.yml b/.github/workflows/beam_PerformanceTests_ManyFiles_TextIOIT_HDFS.yml
index f2ad58c4e6e3..6f7f4b2c340e 100644
--- a/.github/workflows/beam_PerformanceTests_ManyFiles_TextIOIT_HDFS.yml
+++ b/.github/workflows/beam_PerformanceTests_ManyFiles_TextIOIT_HDFS.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java ManyFilesTextIO Performance Test HDFS"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
             --info \
             -Dfilesystem=hdfs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_ManyFiles_TextIOIT_HDFS_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_ManyFiles_TextIOIT_HDFS_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_MongoDBIO_IT.yml b/.github/workflows/beam_PerformanceTests_MongoDBIO_IT.yml
index 5bd3d6a271f2..296058d9fc9f 100644
--- a/.github/workflows/beam_PerformanceTests_MongoDBIO_IT.yml
+++ b/.github/workflows/beam_PerformanceTests_MongoDBIO_IT.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java MongoDBIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PerformanceTests_ParquetIOIT.yml b/.github/workflows/beam_PerformanceTests_ParquetIOIT.yml
index 7b187a636f54..aa5833f94d3b 100644
--- a/.github/workflows/beam_PerformanceTests_ParquetIOIT.yml
+++ b/.github/workflows/beam_PerformanceTests_ParquetIOIT.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java ParquetIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -90,4 +92,4 @@ jobs:
             --info \
             -Dfilesystem=gcs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_ParquetIOIT_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_ParquetIOIT_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_ParquetIOIT_HDFS.yml b/.github/workflows/beam_PerformanceTests_ParquetIOIT_HDFS.yml
index 7496a7e89e56..ab2777129875 100644
--- a/.github/workflows/beam_PerformanceTests_ParquetIOIT_HDFS.yml
+++ b/.github/workflows/beam_PerformanceTests_ParquetIOIT_HDFS.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java ParquetIO Performance Test HDFS"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
             --info \
             -Dfilesystem=hdfs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_ParquetIOIT_HDFS_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_ParquetIOIT_HDFS_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_PubsubIOIT_Python_Streaming.yml b/.github/workflows/beam_PerformanceTests_PubsubIOIT_Python_Streaming.yml
index 4d23c0a832d2..72c9783790fe 100644
--- a/.github/workflows/beam_PerformanceTests_PubsubIOIT_Python_Streaming.yml
+++ b/.github/workflows/beam_PerformanceTests_PubsubIOIT_Python_Streaming.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run PubsubIO Performance Test Python"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.io.gcp.pubsub_io_perf_test \
             -Prunner=TestDataflowRunner \
             -PpythonVersion=3.10 \
-            '-PloadTest.args=${{ env.beam_PerformanceTests_PubsubIOIT_Python_Streaming_test_arguments_1 }}'
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_PerformanceTests_PubsubIOIT_Python_Streaming_test_arguments_1 }}'
diff --git a/.github/workflows/beam_PerformanceTests_SQLBigQueryIO_Batch_Java.yml b/.github/workflows/beam_PerformanceTests_SQLBigQueryIO_Batch_Java.yml
index 07b7c30c5aed..bf573fa5f9a9 100644
--- a/.github/workflows/beam_PerformanceTests_SQLBigQueryIO_Batch_Java.yml
+++ b/.github/workflows/beam_PerformanceTests_SQLBigQueryIO_Batch_Java.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run SQLBigQueryIO Batch Performance Test Java"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PerformanceTests_SingleStoreIO.yml b/.github/workflows/beam_PerformanceTests_SingleStoreIO.yml
index 91063b956765..a444a88a1ea8 100644
--- a/.github/workflows/beam_PerformanceTests_SingleStoreIO.yml
+++ b/.github/workflows/beam_PerformanceTests_SingleStoreIO.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java SingleStoreIO Performance Test'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -111,4 +113,4 @@ jobs:
             --tests org.apache.beam.sdk.io.singlestore.SingleStoreIOPerformanceIT \
             --info \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_SingleStoreIO_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_SingleStoreIO_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_SpannerIO_Read_2GB_Python.yml b/.github/workflows/beam_PerformanceTests_SpannerIO_Read_2GB_Python.yml
index 053aaff33cc4..e27ccd91c637 100644
--- a/.github/workflows/beam_PerformanceTests_SpannerIO_Read_2GB_Python.yml
+++ b/.github/workflows/beam_PerformanceTests_SpannerIO_Read_2GB_Python.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run SpannerIO Read 2GB Performance Test Python"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.io.gcp.experimental.spannerio_read_perf_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            -PloadTest.args='${{env.beam_PerformanceTests_SpannerIO_Read_2GB_Python_test_arguments_1}}'
\ No newline at end of file
+            -PloadTest.args='${{env.beam_PerformanceTests_SpannerIO_Read_2GB_Python_test_arguments_1}}'
diff --git a/.github/workflows/beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch.yml b/.github/workflows/beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch.yml
index beeaf2d67078..68ae38d8de49 100644
--- a/.github/workflows/beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch.yml
+++ b/.github/workflows/beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run SpannerIO Write 2GB Performance Test Python Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
             -PloadTest.mainClass=apache_beam.io.gcp.experimental.spannerio_write_perf_test \
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
-            -PloadTest.args='${{env.beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch_test_arguments_1}}'
\ No newline at end of file
+            -PloadTest.args='${{env.beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch_test_arguments_1}}'
diff --git a/.github/workflows/beam_PerformanceTests_SparkReceiver_IO.yml b/.github/workflows/beam_PerformanceTests_SparkReceiver_IO.yml
index 7ac0cedb9cb6..ade25aacde3b 100644
--- a/.github/workflows/beam_PerformanceTests_SparkReceiver_IO.yml
+++ b/.github/workflows/beam_PerformanceTests_SparkReceiver_IO.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java SparkReceiverIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PerformanceTests_TFRecordIOIT.yml b/.github/workflows/beam_PerformanceTests_TFRecordIOIT.yml
index 6103e6180eee..b7db2577e9b9 100644
--- a/.github/workflows/beam_PerformanceTests_TFRecordIOIT.yml
+++ b/.github/workflows/beam_PerformanceTests_TFRecordIOIT.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java TFRecordIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -90,4 +92,4 @@ jobs:
             --info \
             -Dfilesystem=gcs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_TFRecordIOIT_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_TFRecordIOIT_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_TFRecordIOIT_HDFS.yml b/.github/workflows/beam_PerformanceTests_TFRecordIOIT_HDFS.yml
index 5a3f22f858fd..9808f89b4d44 100644
--- a/.github/workflows/beam_PerformanceTests_TFRecordIOIT_HDFS.yml
+++ b/.github/workflows/beam_PerformanceTests_TFRecordIOIT_HDFS.yml
@@ -65,6 +65,8 @@ jobs:
         job_phrase: ["Run Java TFRecordIO Performance Test HDFS"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -105,4 +107,4 @@ jobs:
             --tests org.apache.beam.sdk.io.tfrecord.TFRecordIOIT \
             -Dfilesystem=hdfs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_TFRecordIOIT_HDFS_test_arguments_1 }}]' \
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_TFRecordIOIT_HDFS_test_arguments_1 }}]' \
diff --git a/.github/workflows/beam_PerformanceTests_TextIOIT.yml b/.github/workflows/beam_PerformanceTests_TextIOIT.yml
index a3cf7033f7eb..ebf57d7ba7dd 100644
--- a/.github/workflows/beam_PerformanceTests_TextIOIT.yml
+++ b/.github/workflows/beam_PerformanceTests_TextIOIT.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java TextIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -90,4 +92,4 @@ jobs:
             --info \
             -Dfilesystem=gcs \
             -DintegrationTestRunner=dataflow \
-            '-DintegrationTestPipelineOptions=[${{env.beam_PerformanceTests_TextIOIT_test_arguments_1}}]'
\ No newline at end of file
+            '-DintegrationTestPipelineOptions=[${{env.beam_PerformanceTests_TextIOIT_test_arguments_1}}]'
diff --git a/.github/workflows/beam_PerformanceTests_TextIOIT_HDFS.yml b/.github/workflows/beam_PerformanceTests_TextIOIT_HDFS.yml
index 01820ac6bb70..a29d3ecb69a8 100644
--- a/.github/workflows/beam_PerformanceTests_TextIOIT_HDFS.yml
+++ b/.github/workflows/beam_PerformanceTests_TextIOIT_HDFS.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java TextIO Performance Test HDFS"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -103,4 +105,4 @@ jobs:
             --info \
             -Dfilesystem=hdfs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{env.beam_PerformanceTests_TextIOIT_HDFS_test_arguments_1}}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{env.beam_PerformanceTests_TextIOIT_HDFS_test_arguments_1}}]'
diff --git a/.github/workflows/beam_PerformanceTests_TextIOIT_Python.yml b/.github/workflows/beam_PerformanceTests_TextIOIT_Python.yml
index c25afec144c7..8ab9e611b89b 100644
--- a/.github/workflows/beam_PerformanceTests_TextIOIT_Python.yml
+++ b/.github/workflows/beam_PerformanceTests_TextIOIT_Python.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Python TextIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
             -PpythonVersion=3.10 \
             -PloadTest.mainClass=apache_beam.io.filebasedio_perf_test \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{env.beam_PerformanceTests_TextIOIT_Python_test_arguments_1}}'
\ No newline at end of file
+            '-PloadTest.args=${{env.beam_PerformanceTests_TextIOIT_Python_test_arguments_1}}'
diff --git a/.github/workflows/beam_PerformanceTests_WordCountIT_PythonVersions.yml b/.github/workflows/beam_PerformanceTests_WordCountIT_PythonVersions.yml
index 927bc7960442..95339bfe2c1f 100644
--- a/.github/workflows/beam_PerformanceTests_WordCountIT_PythonVersions.yml
+++ b/.github/workflows/beam_PerformanceTests_WordCountIT_PythonVersions.yml
@@ -67,6 +67,8 @@ jobs:
         python_version: ['3.10']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -116,4 +118,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PerformanceTests_XmlIOIT.yml b/.github/workflows/beam_PerformanceTests_XmlIOIT.yml
index 135a80a8aef6..472c832b94ea 100644
--- a/.github/workflows/beam_PerformanceTests_XmlIOIT.yml
+++ b/.github/workflows/beam_PerformanceTests_XmlIOIT.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java XmlIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -90,4 +92,4 @@ jobs:
             --info \
             -Dfilesystem=gcs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_XmlIOIT_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_XmlIOIT_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_XmlIOIT_HDFS.yml b/.github/workflows/beam_PerformanceTests_XmlIOIT_HDFS.yml
index c11a2f34479f..a685796c4f44 100644
--- a/.github/workflows/beam_PerformanceTests_XmlIOIT_HDFS.yml
+++ b/.github/workflows/beam_PerformanceTests_XmlIOIT_HDFS.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java XmlIO Performance Test HDFS"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
             --info \
             -Dfilesystem=hdfs \
             -DintegrationTestRunner=dataflow \
-            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_XmlIOIT_HDFS_test_arguments_1 }}]'
\ No newline at end of file
+            -DintegrationTestPipelineOptions='[${{ env.beam_PerformanceTests_XmlIOIT_HDFS_test_arguments_1 }}]'
diff --git a/.github/workflows/beam_PerformanceTests_xlang_KafkaIO_Python.yml b/.github/workflows/beam_PerformanceTests_xlang_KafkaIO_Python.yml
index 94c556e4c475..dc467080b1f9 100644
--- a/.github/workflows/beam_PerformanceTests_xlang_KafkaIO_Python.yml
+++ b/.github/workflows/beam_PerformanceTests_xlang_KafkaIO_Python.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Python xlang KafkaIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_Playground_CI_Nightly.yml b/.github/workflows/beam_Playground_CI_Nightly.yml
index 539cdeddc2b8..690e8c00b76b 100644
--- a/.github/workflows/beam_Playground_CI_Nightly.yml
+++ b/.github/workflows/beam_Playground_CI_Nightly.yml
@@ -62,6 +62,8 @@ jobs:
       fail-fast: false
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
@@ -90,7 +92,7 @@ jobs:
           echo "container_id=$CONTAINER_ID" >> $GITHUB_ENV
       - name: Get Container IP
         run: |
-          CONTAINER_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' ${{ env.container_id }})
+          CONTAINER_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' ${container_id})
           echo "container_ip=$CONTAINER_IP" >> $GITHUB_ENV
       - name: Run CI
         env:
diff --git a/.github/workflows/beam_Playground_Precommit.yml b/.github/workflows/beam_Playground_Precommit.yml
index da253cc11bfd..5bcc4dfd2afa 100644
--- a/.github/workflows/beam_Playground_Precommit.yml
+++ b/.github/workflows/beam_Playground_Precommit.yml
@@ -48,6 +48,8 @@ jobs:
       JAVA_VERSION: '17'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Go.yml b/.github/workflows/beam_PostCommit_Go.yml
index 3da9821cefad..42bbd8a49387 100644
--- a/.github/workflows/beam_PostCommit_Go.yml
+++ b/.github/workflows/beam_PostCommit_Go.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Go PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -85,4 +87,4 @@ jobs:
           gradle-command: :goPostCommit
           arguments: |
             --no-parallel \
-            -Pdocker-repository-root=us.gcr.io/apache-beam-testing/github-actions
\ No newline at end of file
+            -Pdocker-repository-root=us.gcr.io/apache-beam-testing/github-actions
diff --git a/.github/workflows/beam_PostCommit_Go_Dataflow_ARM.yml b/.github/workflows/beam_PostCommit_Go_Dataflow_ARM.yml
index 64667f10736c..598cef3a2f68 100644
--- a/.github/workflows/beam_PostCommit_Go_Dataflow_ARM.yml
+++ b/.github/workflows/beam_PostCommit_Go_Dataflow_ARM.yml
@@ -66,6 +66,8 @@ jobs:
         job_phrase: ["Run Go PostCommit Dataflow ARM"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Go_VR_Flink.yml b/.github/workflows/beam_PostCommit_Go_VR_Flink.yml
index d476e36a4cc2..5f9173fa275c 100644
--- a/.github/workflows/beam_PostCommit_Go_VR_Flink.yml
+++ b/.github/workflows/beam_PostCommit_Go_VR_Flink.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Go Flink ValidatesRunner"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -77,4 +79,4 @@ jobs:
           CLOUDSDK_CONFIG: ${{ env.KUBELET_GCLOUD_CONFIG_PATH}}
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:go:test:flinkValidatesRunner
\ No newline at end of file
+          gradle-command: :sdks:go:test:flinkValidatesRunner
diff --git a/.github/workflows/beam_PostCommit_Go_VR_Spark.yml b/.github/workflows/beam_PostCommit_Go_VR_Spark.yml
index 34df660a2b55..63905b9483f6 100644
--- a/.github/workflows/beam_PostCommit_Go_VR_Spark.yml
+++ b/.github/workflows/beam_PostCommit_Go_VR_Spark.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Go Spark ValidatesRunner"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -78,4 +80,4 @@ jobs:
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
           gradle-command: :sdks:go:test:sparkValidatesRunner
-          
\ No newline at end of file
+          
diff --git a/.github/workflows/beam_PostCommit_Java.yml b/.github/workflows/beam_PostCommit_Java.yml
index 74f1c0a13b69..1afd320b84dd 100644
--- a/.github/workflows/beam_PostCommit_Java.yml
+++ b/.github/workflows/beam_PostCommit_Java.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java PostCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Avro_Versions.yml b/.github/workflows/beam_PostCommit_Java_Avro_Versions.yml
index f702e0a15690..f6362b48b41f 100644
--- a/.github/workflows/beam_PostCommit_Java_Avro_Versions.yml
+++ b/.github/workflows/beam_PostCommit_Java_Avro_Versions.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Avro Versions PostCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_BigQueryEarlyRollout.yml b/.github/workflows/beam_PostCommit_Java_BigQueryEarlyRollout.yml
index 89201eadcd5f..1b604b2d3986 100644
--- a/.github/workflows/beam_PostCommit_Java_BigQueryEarlyRollout.yml
+++ b/.github/workflows/beam_PostCommit_Java_BigQueryEarlyRollout.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java BigQueryEarlyRollout PostCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_DataflowV1.yml b/.github/workflows/beam_PostCommit_Java_DataflowV1.yml
index 35eb3d331c0f..05d4132b2535 100644
--- a/.github/workflows/beam_PostCommit_Java_DataflowV1.yml
+++ b/.github/workflows/beam_PostCommit_Java_DataflowV1.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run PostCommit_Java_Dataflow'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -93,4 +95,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_DataflowV2.yml b/.github/workflows/beam_PostCommit_Java_DataflowV2.yml
index 5c38e94ed7dd..c2b636035483 100644
--- a/.github/workflows/beam_PostCommit_Java_DataflowV2.yml
+++ b/.github/workflows/beam_PostCommit_Java_DataflowV2.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run PostCommit_Java_DataflowV2'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow.yml b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow.yml
index 4acbb637a6d7..696d9496268a 100644
--- a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Examples on Dataflow'
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup repository
       uses: ./.github/actions/setup-action
       with:
@@ -90,4 +92,4 @@ jobs:
       if: always()
       with:
         files: '**/build/test-results/**/*.xml'
-        large_files: true
\ No newline at end of file
+        large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_ARM.yml b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_ARM.yml
index fb6b6df52768..ec09bed695b7 100644
--- a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_ARM.yml
+++ b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_ARM.yml
@@ -71,6 +71,8 @@ jobs:
       startswith(github.event.comment.body, 'Run Java_Examples_Dataflow_ARM PostCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_Java.yml b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_Java.yml
index a33513af45ac..51b2593e1c7d 100644
--- a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_Java.yml
+++ b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_Java.yml
@@ -68,6 +68,8 @@ jobs:
       startswith(github.event.comment.body, 'Run Java examples on Dataflow Java')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -98,4 +100,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_V2.yml b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_V2.yml
index 4b95f1674664..c36c9db7d8c0 100644
--- a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_V2.yml
+++ b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_V2.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Examples on Dataflow Runner V2'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml
index a2ef615b8c5f..762ab81e75a6 100644
--- a/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml
+++ b/.github/workflows/beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml
@@ -70,6 +70,8 @@ jobs:
          contains(github.event.comment.body, 'Examples on Dataflow Runner V2'))
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -105,4 +107,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Examples_Direct.yml b/.github/workflows/beam_PostCommit_Java_Examples_Direct.yml
index 27fbbdd82bbc..469706c6f6c5 100644
--- a/.github/workflows/beam_PostCommit_Java_Examples_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Java_Examples_Direct.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Examples_Direct'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -93,4 +95,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Examples_Flink.yml b/.github/workflows/beam_PostCommit_Java_Examples_Flink.yml
index 765953d23d51..c58721208eaa 100644
--- a/.github/workflows/beam_PostCommit_Java_Examples_Flink.yml
+++ b/.github/workflows/beam_PostCommit_Java_Examples_Flink.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Examples_Flink'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Examples_Spark.yml b/.github/workflows/beam_PostCommit_Java_Examples_Spark.yml
index caa22f10e0ff..f3332996ed8d 100644
--- a/.github/workflows/beam_PostCommit_Java_Examples_Spark.yml
+++ b/.github/workflows/beam_PostCommit_Java_Examples_Spark.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Examples_Spark'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -93,4 +95,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Hadoop_Versions.yml b/.github/workflows/beam_PostCommit_Java_Hadoop_Versions.yml
index 37102fa1918e..4b0ad8033944 100644
--- a/.github/workflows/beam_PostCommit_Java_Hadoop_Versions.yml
+++ b/.github/workflows/beam_PostCommit_Java_Hadoop_Versions.yml
@@ -64,6 +64,8 @@ jobs:
       github.event.comment.body == 'Run PostCommit_Java_Hadoop_Versions'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -89,4 +91,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_IO_Performance_Tests.yml b/.github/workflows/beam_PostCommit_Java_IO_Performance_Tests.yml
index db43441f2cda..383db7e137fd 100644
--- a/.github/workflows/beam_PostCommit_Java_IO_Performance_Tests.yml
+++ b/.github/workflows/beam_PostCommit_Java_IO_Performance_Tests.yml
@@ -67,6 +67,8 @@ jobs:
         test_case: ["GCSPerformanceTest", "BigTablePerformanceTest", "BigQueryStorageApiStreamingPerformanceTest"]
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup repository
       uses: ./.github/actions/setup-action
       with:
@@ -84,6 +86,7 @@ jobs:
       with:
         ref: ${{ env.BEAM_VERSION }}
         repository: apache/beam
+        persist-credentials: false
     - name: Setup environment
       uses: ./.github/actions/setup-environment-action
       with:
diff --git a/.github/workflows/beam_PostCommit_Java_InfluxDbIO_IT.yml b/.github/workflows/beam_PostCommit_Java_InfluxDbIO_IT.yml
index 91f79a68c56c..32a42305b760 100644
--- a/.github/workflows/beam_PostCommit_Java_InfluxDbIO_IT.yml
+++ b/.github/workflows/beam_PostCommit_Java_InfluxDbIO_IT.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java InfluxDbIO_IT'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Jpms_Dataflow.yml b/.github/workflows/beam_PostCommit_Java_Jpms_Dataflow.yml
index b3b1e54ae9ea..e68262f69ab8 100644
--- a/.github/workflows/beam_PostCommit_Java_Jpms_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Java_Jpms_Dataflow.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Jpms Dataflow PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Jpms_Dataflow_Versions.yml b/.github/workflows/beam_PostCommit_Java_Jpms_Dataflow_Versions.yml
index de1b6417f8e9..07eff3d9cb8b 100644
--- a/.github/workflows/beam_PostCommit_Java_Jpms_Dataflow_Versions.yml
+++ b/.github/workflows/beam_PostCommit_Java_Jpms_Dataflow_Versions.yml
@@ -65,6 +65,8 @@ jobs:
         java_version: ["17", "21", "25"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Jpms_Direct.yml b/.github/workflows/beam_PostCommit_Java_Jpms_Direct.yml
index dd627b7bd235..cbeb2f1a38c6 100644
--- a/.github/workflows/beam_PostCommit_Java_Jpms_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Java_Jpms_Direct.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Jpms Direct PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Jpms_Direct_Versions.yml b/.github/workflows/beam_PostCommit_Java_Jpms_Direct_Versions.yml
index fa2f0c5753b4..a3d6a54b5375 100644
--- a/.github/workflows/beam_PostCommit_Java_Jpms_Direct_Versions.yml
+++ b/.github/workflows/beam_PostCommit_Java_Jpms_Direct_Versions.yml
@@ -65,6 +65,8 @@ jobs:
         java_version: ["17", "21", "25"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Jpms_Flink_Java11.yml b/.github/workflows/beam_PostCommit_Java_Jpms_Flink_Java11.yml
index 1501eae26b61..cfbff90970c0 100644
--- a/.github/workflows/beam_PostCommit_Java_Jpms_Flink_Java11.yml
+++ b/.github/workflows/beam_PostCommit_Java_Jpms_Flink_Java11.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Jpms Flink Java 11 PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -92,4 +94,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Jpms_Spark_Java11.yml b/.github/workflows/beam_PostCommit_Java_Jpms_Spark_Java11.yml
index 21ea989f2758..1077065388fe 100644
--- a/.github/workflows/beam_PostCommit_Java_Jpms_Spark_Java11.yml
+++ b/.github/workflows/beam_PostCommit_Java_Jpms_Spark_Java11.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Jpms Spark Java 11 PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -92,4 +94,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow.yml b/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow.yml
index ff94638922fa..a88281151e5a 100644
--- a/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow.yml
@@ -94,6 +94,8 @@ jobs:
       github.event.comment.body == 'Run Dataflow Runner Nexmark Tests'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
           gradle-command: :sdks:java:testing:nexmark:run
           arguments: |
             -Pnexmark.runner=:runners:google-cloud-dataflow-java \
-            "${{ env.GRADLE_COMMAND_ARGUMENTS }}--streaming=${{ matrix.streaming }}"
\ No newline at end of file
+            "${{ env.GRADLE_COMMAND_ARGUMENTS }}--streaming=${{ matrix.streaming }}"
diff --git a/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow_V2.yml b/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow_V2.yml
index 81916d8fe7a5..ba00e5cf8cbc 100644
--- a/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow_V2.yml
+++ b/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow_V2.yml
@@ -94,6 +94,8 @@ jobs:
       github.event.comment.body == 'Run Dataflow Runner V2 Nexmark Tests'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -115,4 +117,4 @@ jobs:
             -Pjava8Home=$JAVA_HOME_8_X64 \
             -Pnexmark.runner.version=V2 \
             -Pnexmark.runner=:runners:google-cloud-dataflow-java \
-            '${{ env.GRADLE_COMMAND_ARGUMENTS }}--streaming=${{ matrix.streaming }}'
\ No newline at end of file
+            '${{ env.GRADLE_COMMAND_ARGUMENTS }}--streaming=${{ matrix.streaming }}'
diff --git a/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml b/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml
index a58e814c5567..a3410e4acc00 100644
--- a/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml
+++ b/.github/workflows/beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml
@@ -96,6 +96,8 @@ jobs:
          contains(github.event.comment.body, 'Nexmark Tests'))
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -115,4 +117,4 @@ jobs:
             -Pjava${{ matrix.java_version }}Home=$JAVA_HOME_${{ matrix.java_version }}_X64 \
             -Pnexmark.runner.version=V2 \
             -Pnexmark.runner=:runners:google-cloud-dataflow-java \
-            '${{ env.GRADLE_COMMAND_ARGUMENTS }}--influxTags={"runnerVersion":"V2","javaVersion":"${{ matrix.java_version }}"}--streaming=${{ matrix.streaming }}'
\ No newline at end of file
+            '${{ env.GRADLE_COMMAND_ARGUMENTS }}--influxTags={"runnerVersion":"V2","javaVersion":"${{ matrix.java_version }}"}--streaming=${{ matrix.streaming }}'
diff --git a/.github/workflows/beam_PostCommit_Java_Nexmark_Direct.yml b/.github/workflows/beam_PostCommit_Java_Nexmark_Direct.yml
index 5175f8db2176..aa87c809038b 100644
--- a/.github/workflows/beam_PostCommit_Java_Nexmark_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Java_Nexmark_Direct.yml
@@ -89,6 +89,8 @@ jobs:
       github.event.comment.body == 'Run Direct Runner Nexmark Tests'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -112,4 +114,4 @@ jobs:
           gradle-command: :sdks:java:testing:nexmark:run
           arguments: |
             -Pnexmark.runner=:runners:direct-java \
-            "${{ env.GRADLE_COMMAND_ARGUMENTS }}--streaming=${{ matrix.streaming }}"
\ No newline at end of file
+            "${{ env.GRADLE_COMMAND_ARGUMENTS }}--streaming=${{ matrix.streaming }}"
diff --git a/.github/workflows/beam_PostCommit_Java_Nexmark_Flink.yml b/.github/workflows/beam_PostCommit_Java_Nexmark_Flink.yml
index f64a9bd41fb6..11d015633db7 100644
--- a/.github/workflows/beam_PostCommit_Java_Nexmark_Flink.yml
+++ b/.github/workflows/beam_PostCommit_Java_Nexmark_Flink.yml
@@ -88,6 +88,8 @@ jobs:
       github.event.comment.body == 'Run Flink Runner Nexmark Tests'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Nexmark_Spark.yml b/.github/workflows/beam_PostCommit_Java_Nexmark_Spark.yml
index 99ed344def91..ea18aad79c39 100644
--- a/.github/workflows/beam_PostCommit_Java_Nexmark_Spark.yml
+++ b/.github/workflows/beam_PostCommit_Java_Nexmark_Spark.yml
@@ -88,6 +88,8 @@ jobs:
       github.event.comment.body == 'Run Spark Runner Nexmark Tests'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -111,4 +113,4 @@ jobs:
           gradle-command: :sdks:java:testing:nexmark:run
           arguments: |
             -Pnexmark.runner=:runners:spark:3 \
-            "${{ env.GRADLE_COMMAND_ARGUMENTS }}--runner=${{ matrix.runner }}"
\ No newline at end of file
+            "${{ env.GRADLE_COMMAND_ARGUMENTS }}--runner=${{ matrix.runner }}"
diff --git a/.github/workflows/beam_PostCommit_Java_PVR_Flink_Batch.yml b/.github/workflows/beam_PostCommit_Java_PVR_Flink_Batch.yml
index 10138c8425e4..b900ccace0cf 100644
--- a/.github/workflows/beam_PostCommit_Java_PVR_Flink_Batch.yml
+++ b/.github/workflows/beam_PostCommit_Java_PVR_Flink_Batch.yml
@@ -80,6 +80,8 @@ jobs:
       github.event.comment.body == 'Run Java_PVR_Flink_Batch PostCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_PVR_Flink_Streaming.yml b/.github/workflows/beam_PostCommit_Java_PVR_Flink_Streaming.yml
index 45d9a95ac9b1..3961475de33f 100644
--- a/.github/workflows/beam_PostCommit_Java_PVR_Flink_Streaming.yml
+++ b/.github/workflows/beam_PostCommit_Java_PVR_Flink_Streaming.yml
@@ -68,6 +68,8 @@ jobs:
       github.event.comment.body == 'Run Java Flink PortableValidatesRunner Streaming'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_PVR_Spark3_Streaming.yml b/.github/workflows/beam_PostCommit_Java_PVR_Spark3_Streaming.yml
index ce51a09ada02..aef3f86655ac 100644
--- a/.github/workflows/beam_PostCommit_Java_PVR_Spark3_Streaming.yml
+++ b/.github/workflows/beam_PostCommit_Java_PVR_Spark3_Streaming.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Spark v3 PortableValidatesRunner Streaming'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_PVR_Spark4_Batch.yml b/.github/workflows/beam_PostCommit_Java_PVR_Spark4_Batch.yml
index 4442e8c55ff1..331b0f5f49cc 100644
--- a/.github/workflows/beam_PostCommit_Java_PVR_Spark4_Batch.yml
+++ b/.github/workflows/beam_PostCommit_Java_PVR_Spark4_Batch.yml
@@ -65,6 +65,8 @@ jobs:
       (github.event_name == 'schedule' && github.repository == 'apache/beam')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_PVR_Spark4_Streaming.yml b/.github/workflows/beam_PostCommit_Java_PVR_Spark4_Streaming.yml
index 7a66f317c974..0ef53787a8ff 100644
--- a/.github/workflows/beam_PostCommit_Java_PVR_Spark4_Streaming.yml
+++ b/.github/workflows/beam_PostCommit_Java_PVR_Spark4_Streaming.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Spark v4 PortableValidatesRunner Streaming'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -93,4 +95,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_PVR_Spark_Batch.yml b/.github/workflows/beam_PostCommit_Java_PVR_Spark_Batch.yml
index f14e32ad2901..2c0a09430416 100644
--- a/.github/workflows/beam_PostCommit_Java_PVR_Spark_Batch.yml
+++ b/.github/workflows/beam_PostCommit_Java_PVR_Spark_Batch.yml
@@ -65,6 +65,8 @@ jobs:
       (github.event_name == 'schedule' && github.repository == 'apache/beam')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_SingleStoreIO_IT.yml b/.github/workflows/beam_PostCommit_Java_SingleStoreIO_IT.yml
index 3fb73d6c1311..938149972df5 100644
--- a/.github/workflows/beam_PostCommit_Java_SingleStoreIO_IT.yml
+++ b/.github/workflows/beam_PostCommit_Java_SingleStoreIO_IT.yml
@@ -68,6 +68,8 @@ jobs:
       github.event.comment.body == 'Run Java SingleStoreIO_IT'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Tpcds_Dataflow.yml b/.github/workflows/beam_PostCommit_Java_Tpcds_Dataflow.yml
index ea822f0895e0..fb57bebdc510 100644
--- a/.github/workflows/beam_PostCommit_Java_Tpcds_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Java_Tpcds_Dataflow.yml
@@ -91,6 +91,8 @@ jobs:
         job_phrase: ["Run Dataflow Runner Tpcds Tests"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Tpcds_Flink.yml b/.github/workflows/beam_PostCommit_Java_Tpcds_Flink.yml
index a96dc9416e24..07d275553447 100644
--- a/.github/workflows/beam_PostCommit_Java_Tpcds_Flink.yml
+++ b/.github/workflows/beam_PostCommit_Java_Tpcds_Flink.yml
@@ -88,6 +88,8 @@ jobs:
         job_phrase: ["Run Flink Runner Tpcds Tests"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_Tpcds_Spark.yml b/.github/workflows/beam_PostCommit_Java_Tpcds_Spark.yml
index 2204670a6caf..6b03a2890158 100644
--- a/.github/workflows/beam_PostCommit_Java_Tpcds_Spark.yml
+++ b/.github/workflows/beam_PostCommit_Java_Tpcds_Spark.yml
@@ -87,6 +87,8 @@ jobs:
         runner: [SparkRunner, SparkStructuredStreamingRunner]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow.yml
index 1bdf330ffbb5..74adf33c4ba1 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Dataflow ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -94,4 +96,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml
index 750621a7c43b..99128e5eb599 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml
@@ -68,6 +68,8 @@ jobs:
       startswith(github.event.comment.body, 'Run Dataflow ValidatesRunner Java')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -101,4 +103,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml
index 7a4133d7c425..bb38a8c1b542 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Dataflow Streaming ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -94,4 +96,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml
index d1501a8696e6..ede9147ca119 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml
@@ -65,6 +65,8 @@ jobs:
       github.event.comment.body == 'Run Dataflow Streaming Engine ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml
index 204fd44ed9d1..93efd86931b8 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Dataflow Streaming TagEncodingV2 ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml
index c85d7c4cac63..60a88cfad3c8 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Dataflow V2 ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -94,4 +96,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml
index 679cc01cc0ea..08fec63a0adf 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Java Dataflow V2 ValidatesRunner Streaming'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -101,4 +103,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Direct.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Direct.yml
index c69a5ce9704a..92d44315dc91 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Direct.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Direct ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml
index ec7f63b011f5..5d9ec380019e 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml
@@ -68,6 +68,8 @@ jobs:
       startswith(github.event.comment.body, 'Run Direct ValidatesRunner Java')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -100,4 +102,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Flink.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Flink.yml
index d33b3b412498..679c22b627d3 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Flink.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Flink.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Flink ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Spark.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Spark.yml
index 9f8af5d6699e..0accb7809946 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Spark.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Spark.yml
@@ -64,6 +64,8 @@ jobs:
       github.event.comment.body == 'Run Spark ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Spark4.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Spark4.yml
index 704539ac92de..6b7b66d64e43 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Spark4.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Spark4.yml
@@ -64,6 +64,8 @@ jobs:
       github.event.comment.body == 'Run Spark4 ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml
index 75bc7a1ddf94..80173f2ec212 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml
@@ -64,6 +64,8 @@ jobs:
       github.event.comment.body == 'Run Spark StructuredStreaming ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Twister2.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Twister2.yml
index 83e0bef0c0f5..0579fa2c89a1 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Twister2.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_Twister2.yml
@@ -64,6 +64,8 @@ jobs:
       github.event.comment.body == 'Run Twister2 ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -91,4 +93,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_ULR.yml b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_ULR.yml
index d84409f839e8..512b94cae0aa 100644
--- a/.github/workflows/beam_PostCommit_Java_ValidatesRunner_ULR.yml
+++ b/.github/workflows/beam_PostCommit_Java_ValidatesRunner_ULR.yml
@@ -64,6 +64,8 @@ jobs:
       github.event.comment.body == 'Run ULR Loopback ValidatesRunner'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -90,4 +92,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Javadoc.yml b/.github/workflows/beam_PostCommit_Javadoc.yml
index 53a967406f07..2ed3777d1514 100644
--- a/.github/workflows/beam_PostCommit_Javadoc.yml
+++ b/.github/workflows/beam_PostCommit_Javadoc.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run Javadoc PostCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -90,4 +92,4 @@ jobs:
         uses: actions/upload-artifact@v7
         with:
           name: Javadoc Results
-          path: '**/sdks/java/javadoc/build/docs/javadoc/**'
\ No newline at end of file
+          path: '**/sdks/java/javadoc/build/docs/javadoc/**'
diff --git a/.github/workflows/beam_PostCommit_PortableJar_Flink.yml b/.github/workflows/beam_PostCommit_PortableJar_Flink.yml
index 0764e7d89fb4..4d3571eecff1 100644
--- a/.github/workflows/beam_PostCommit_PortableJar_Flink.yml
+++ b/.github/workflows/beam_PostCommit_PortableJar_Flink.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run PortableJar_Flink PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_PortableJar_Spark.yml b/.github/workflows/beam_PostCommit_PortableJar_Spark.yml
index 5840f3d9b6d4..2a7ef43d6a9d 100644
--- a/.github/workflows/beam_PostCommit_PortableJar_Spark.yml
+++ b/.github/workflows/beam_PostCommit_PortableJar_Spark.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run PortableJar_Spark PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -95,4 +97,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Python.yml b/.github/workflows/beam_PostCommit_Python.yml
index 5d9d45b54bd3..f9df7e2583ea 100644
--- a/.github/workflows/beam_PostCommit_Python.yml
+++ b/.github/workflows/beam_PostCommit_Python.yml
@@ -70,6 +70,8 @@ jobs:
       startswith(github.event.comment.body, 'Run Python PostCommit 3.')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Arm.yml b/.github/workflows/beam_PostCommit_Python_Arm.yml
index cb4b3c7cf5cf..39a07fef947f 100644
--- a/.github/workflows/beam_PostCommit_Python_Arm.yml
+++ b/.github/workflows/beam_PostCommit_Python_Arm.yml
@@ -67,6 +67,8 @@ jobs:
       (github.event_name == 'schedule' && github.repository == 'apache/beam')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.1
       - name: Setup repository
diff --git a/.github/workflows/beam_PostCommit_Python_Dependency.yml b/.github/workflows/beam_PostCommit_Python_Dependency.yml
index 1bd982860afd..ed10007829f3 100644
--- a/.github/workflows/beam_PostCommit_Python_Dependency.yml
+++ b/.github/workflows/beam_PostCommit_Python_Dependency.yml
@@ -68,6 +68,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python PostCommit Dependency')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Examples_Dataflow.yml b/.github/workflows/beam_PostCommit_Python_Examples_Dataflow.yml
index 752036143e8e..1eb7c7c6d07e 100644
--- a/.github/workflows/beam_PostCommit_Python_Examples_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Python_Examples_Dataflow.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Python Examples_Dataflow"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Examples_Direct.yml b/.github/workflows/beam_PostCommit_Python_Examples_Direct.yml
index c5f02f1eed2b..98c8f7284655 100644
--- a/.github/workflows/beam_PostCommit_Python_Examples_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Python_Examples_Direct.yml
@@ -66,6 +66,8 @@ jobs:
         python_version: ['3.10','3.11','3.12', '3.13','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Python_Examples_Flink.yml b/.github/workflows/beam_PostCommit_Python_Examples_Flink.yml
index 22607406cafb..b7f987a73dd9 100644
--- a/.github/workflows/beam_PostCommit_Python_Examples_Flink.yml
+++ b/.github/workflows/beam_PostCommit_Python_Examples_Flink.yml
@@ -66,6 +66,8 @@ jobs:
         python_version: ['3.10', '3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Examples_Spark.yml b/.github/workflows/beam_PostCommit_Python_Examples_Spark.yml
index 4a2cb5663195..b9f5f6a705ad 100644
--- a/.github/workflows/beam_PostCommit_Python_Examples_Spark.yml
+++ b/.github/workflows/beam_PostCommit_Python_Examples_Spark.yml
@@ -66,6 +66,8 @@ jobs:
         python_version: ['3.10', '3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Python_MongoDBIO_IT.yml b/.github/workflows/beam_PostCommit_Python_MongoDBIO_IT.yml
index e01b765ff5e7..9c8084df040e 100644
--- a/.github/workflows/beam_PostCommit_Python_MongoDBIO_IT.yml
+++ b/.github/workflows/beam_PostCommit_Python_MongoDBIO_IT.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Python MongoDBIO_IT"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Nexmark_Direct.yml b/.github/workflows/beam_PostCommit_Python_Nexmark_Direct.yml
index 71038c3c8941..69166589b4c1 100644
--- a/.github/workflows/beam_PostCommit_Python_Nexmark_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Python_Nexmark_Direct.yml
@@ -109,6 +109,8 @@ jobs:
       github.event.comment.body == 'Run Python Direct Runner Nexmark Tests'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -136,4 +138,4 @@ jobs:
             -PpythonVersion=3.10 \
             "-Pnexmark.args=${{ env.GRADLE_PYTHON_COMMAND_ARGUMENTS }} \
             --query=${{ matrix.query }} \
-            --input=gs://temp-storage-for-perf-tests/nexmark/eventFiles/beam_PostCommit_Python_Nexmark_Direct/query${{ matrix.query }}-\*"
\ No newline at end of file
+            --input=gs://temp-storage-for-perf-tests/nexmark/eventFiles/beam_PostCommit_Python_Nexmark_Direct/query${{ matrix.query }}-\*"
diff --git a/.github/workflows/beam_PostCommit_Python_Portable_Flink.yml b/.github/workflows/beam_PostCommit_Python_Portable_Flink.yml
index adb4923d7092..9b05df10d94f 100644
--- a/.github/workflows/beam_PostCommit_Python_Portable_Flink.yml
+++ b/.github/workflows/beam_PostCommit_Python_Portable_Flink.yml
@@ -68,6 +68,8 @@ jobs:
         environment_type: ['DOCKER']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow.yml b/.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow.yml
index c03e8999d805..f7e72d7506ed 100644
--- a/.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow.yml
@@ -68,6 +68,8 @@ jobs:
         python_version: ['3.10','3.11','3.12','3.13','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml b/.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml
index 069836fabea3..030250cb06be 100644
--- a/.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml
+++ b/.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml
@@ -66,6 +66,8 @@ jobs:
         python_version: ['3.10','3.11','3.12','3.13','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -125,4 +127,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Dataflow.yml b/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Dataflow.yml
index 4b57013dc4f0..cfce84b677f9 100644
--- a/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Dataflow.yml
@@ -66,6 +66,8 @@ jobs:
         python_version: ['3.10', '3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -110,4 +112,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Flink.yml b/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Flink.yml
index d7fec110ea52..b18a4a6502b5 100644
--- a/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Flink.yml
+++ b/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Flink.yml
@@ -66,6 +66,8 @@ jobs:
         python_version: ['3.10', '3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -104,4 +106,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Spark.yml b/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Spark.yml
index 7d3faaa844ad..0e7ef761eebc 100644
--- a/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Spark.yml
+++ b/.github/workflows/beam_PostCommit_Python_ValidatesRunner_Spark.yml
@@ -66,6 +66,8 @@ jobs:
         python_version: ['3.10', '3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Python_Versions.yml b/.github/workflows/beam_PostCommit_Python_Versions.yml
index b7dd2f500ebd..ef485994fe78 100644
--- a/.github/workflows/beam_PostCommit_Python_Versions.yml
+++ b/.github/workflows/beam_PostCommit_Python_Versions.yml
@@ -89,6 +89,8 @@ jobs:
       github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml b/.github/workflows/beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml
index 3202c29a89ab..e2a131d47cd6 100644
--- a/.github/workflows/beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml
@@ -65,6 +65,8 @@ jobs:
         job_phrase: ["Run Python_Xlang_Gcp_Dataflow PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Xlang_Gcp_Direct.yml b/.github/workflows/beam_PostCommit_Python_Xlang_Gcp_Direct.yml
index 1862512a83db..f1b42681ffeb 100644
--- a/.github/workflows/beam_PostCommit_Python_Xlang_Gcp_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Python_Xlang_Gcp_Direct.yml
@@ -65,6 +65,8 @@ jobs:
         job_phrase: ["Run Python_Xlang_Gcp_Direct PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Xlang_IO_Dataflow.yml b/.github/workflows/beam_PostCommit_Python_Xlang_IO_Dataflow.yml
index 036ba9e25f39..4937807c0c71 100644
--- a/.github/workflows/beam_PostCommit_Python_Xlang_IO_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_Python_Xlang_IO_Dataflow.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Python_Xlang_IO_Dataflow PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Python_Xlang_IO_Direct.yml b/.github/workflows/beam_PostCommit_Python_Xlang_IO_Direct.yml
index d091a6bd6060..3cb5d2a7b8d4 100644
--- a/.github/workflows/beam_PostCommit_Python_Xlang_IO_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Python_Xlang_IO_Direct.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Python_Xlang_IO_Direct PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -99,4 +101,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Python_Xlang_Messaging_Direct.yml b/.github/workflows/beam_PostCommit_Python_Xlang_Messaging_Direct.yml
index ef4c35c189ee..88ac36e8d5d9 100644
--- a/.github/workflows/beam_PostCommit_Python_Xlang_Messaging_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Python_Xlang_Messaging_Direct.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Python_Xlang_Messaging_Direct PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_SQL.yml b/.github/workflows/beam_PostCommit_SQL.yml
index 8c198aa6f38a..22bbe051933d 100644
--- a/.github/workflows/beam_PostCommit_SQL.yml
+++ b/.github/workflows/beam_PostCommit_SQL.yml
@@ -66,6 +66,8 @@ jobs:
       github.event.comment.body == 'Run SQL PostCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_TransformService_Direct.yml b/.github/workflows/beam_PostCommit_TransformService_Direct.yml
index 0da5ed93b202..156b81fc9d56 100644
--- a/.github/workflows/beam_PostCommit_TransformService_Direct.yml
+++ b/.github/workflows/beam_PostCommit_TransformService_Direct.yml
@@ -65,6 +65,8 @@ jobs:
         python_version: ['3.10','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_Website_Test.yml b/.github/workflows/beam_PostCommit_Website_Test.yml
index a0bfce216996..332551e23e30 100644
--- a/.github/workflows/beam_PostCommit_Website_Test.yml
+++ b/.github/workflows/beam_PostCommit_Website_Test.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run Full Website Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -76,4 +78,4 @@ jobs:
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
           gradle-command: :website:testWebsite 
-          arguments: -PdisableExternal=false
\ No newline at end of file
+          arguments: -PdisableExternal=false
diff --git a/.github/workflows/beam_PostCommit_XVR_Direct.yml b/.github/workflows/beam_PostCommit_XVR_Direct.yml
index c8e03769bd04..5200c2fa0a92 100644
--- a/.github/workflows/beam_PostCommit_XVR_Direct.yml
+++ b/.github/workflows/beam_PostCommit_XVR_Direct.yml
@@ -65,6 +65,8 @@ jobs:
         python_version: ['3.10','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -101,4 +103,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_XVR_Flink.yml b/.github/workflows/beam_PostCommit_XVR_Flink.yml
index 273cf5c994cc..6f47d0cdae95 100644
--- a/.github/workflows/beam_PostCommit_XVR_Flink.yml
+++ b/.github/workflows/beam_PostCommit_XVR_Flink.yml
@@ -66,6 +66,8 @@ jobs:
         python_version: ['3.10','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_XVR_GoUsingJava_Dataflow.yml b/.github/workflows/beam_PostCommit_XVR_GoUsingJava_Dataflow.yml
index d9f58f649e0a..3bf6e0e9a676 100644
--- a/.github/workflows/beam_PostCommit_XVR_GoUsingJava_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_XVR_GoUsingJava_Dataflow.yml
@@ -67,6 +67,8 @@ jobs:
         job_phrase: ["Run XVR_GoUsingJava_Dataflow PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_XVR_JavaUsingPython_Dataflow.yml b/.github/workflows/beam_PostCommit_XVR_JavaUsingPython_Dataflow.yml
index 68fa1e646311..2c6ecca80f26 100644
--- a/.github/workflows/beam_PostCommit_XVR_JavaUsingPython_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_XVR_JavaUsingPython_Dataflow.yml
@@ -65,6 +65,8 @@ jobs:
         python_version: ['3.10','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -100,4 +102,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml b/.github/workflows/beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml
index c180e43cc8cc..c19141d7b6ba 100644
--- a/.github/workflows/beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml
@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run XVR_PythonUsingJavaSQL_Dataflow PostCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml b/.github/workflows/beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml
index 1c7bc806c035..355cb6dec997 100644
--- a/.github/workflows/beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml
+++ b/.github/workflows/beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml
@@ -65,6 +65,8 @@ jobs:
         python_version: ['3.10','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostCommit_XVR_Spark3.yml b/.github/workflows/beam_PostCommit_XVR_Spark3.yml
index e303e80a7ea3..3d0b81f4b6c4 100644
--- a/.github/workflows/beam_PostCommit_XVR_Spark3.yml
+++ b/.github/workflows/beam_PostCommit_XVR_Spark3.yml
@@ -65,6 +65,8 @@ jobs:
         python_version: ['3.10','3.14']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -101,4 +103,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PostCommit_Yaml_Xlang_Direct.yml b/.github/workflows/beam_PostCommit_Yaml_Xlang_Direct.yml
index 740c901a2d7b..d32236112448 100644
--- a/.github/workflows/beam_PostCommit_Yaml_Xlang_Direct.yml
+++ b/.github/workflows/beam_PostCommit_Yaml_Xlang_Direct.yml
@@ -64,6 +64,8 @@ jobs:
         test_set: ["data", "databases", "messaging"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PostRelease_NightlySnapshot.yml b/.github/workflows/beam_PostRelease_NightlySnapshot.yml
index f83b6499e582..d4e2e0690cfb 100644
--- a/.github/workflows/beam_PostRelease_NightlySnapshot.yml
+++ b/.github/workflows/beam_PostRelease_NightlySnapshot.yml
@@ -55,6 +55,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, highmem]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
@@ -72,4 +74,6 @@ jobs:
             -PmavenLocalPath='${{ steps.setup_local_maven.outputs.NEW_TEMP_DIR }}'
       - name: Clean up local maven
         if: steps.setup_local_maven.outcome == 'success'
-        run: rm -rf '${{ steps.setup_local_maven.outputs.NEW_TEMP_DIR }}'
+        run: rm -rf '${STEPS_SETUP_LOCAL_MAVEN_OUTPUTS_NEW_TEMP_DIR}'
+        env:
+          STEPS_SETUP_LOCAL_MAVEN_OUTPUTS_NEW_TEMP_DIR: ${{ steps.setup_local_maven.outputs.NEW_TEMP_DIR }}
diff --git a/.github/workflows/beam_PreCommit_CommunityMetrics.yml b/.github/workflows/beam_PreCommit_CommunityMetrics.yml
index 97fd004c2937..e77003613b1e 100644
--- a/.github/workflows/beam_PreCommit_CommunityMetrics.yml
+++ b/.github/workflows/beam_PreCommit_CommunityMetrics.yml
@@ -72,6 +72,8 @@ jobs:
       github.event.comment.body == 'Run CommunityMetrics PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -95,4 +97,4 @@ jobs:
         with:
           gradle-command: :communityMetricsPreCommit
           arguments: |
-            -PKUBE_CONFIG_PATH='$HOME/.kube/config'
\ No newline at end of file
+            -PKUBE_CONFIG_PATH='$HOME/.kube/config'
diff --git a/.github/workflows/beam_PreCommit_Flink_Container.yml b/.github/workflows/beam_PreCommit_Flink_Container.yml
index 7e9571dca6f3..34a7f9469796 100644
--- a/.github/workflows/beam_PreCommit_Flink_Container.yml
+++ b/.github/workflows/beam_PreCommit_Flink_Container.yml
@@ -99,6 +99,8 @@ jobs:
         job_phrase: ["Run Flink Container PreCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -184,4 +186,4 @@ jobs:
       - name: Cleanup Python SDK Container
         if: ${{ always() && github.event_name == 'pull_request_target' }}
         run: |
-          gcloud container images delete ${{ env.DOCKER_REPOSITORY_ROOT }}/beam_python${{ env.PYTHON_VERSION }}_sdk:${{ env.PYTHON_SDK_IMAGE_TAG }} --force-delete-tags --quiet
+          gcloud container images delete ${DOCKER_REPOSITORY_ROOT}/beam_python${{ env.PYTHON_VERSION }}_sdk:${{ env.PYTHON_SDK_IMAGE_TAG }} --force-delete-tags --quiet
diff --git a/.github/workflows/beam_PreCommit_GHA.yml b/.github/workflows/beam_PreCommit_GHA.yml
index af5513a2835e..ec8bec0edb71 100644
--- a/.github/workflows/beam_PreCommit_GHA.yml
+++ b/.github/workflows/beam_PreCommit_GHA.yml
@@ -72,6 +72,8 @@ jobs:
       github.event.comment.body == 'Run GHA PreCommit'
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup repository
       uses: ./.github/actions/setup-action
       with:
@@ -86,4 +88,4 @@ jobs:
     - name: run GHA PreCommit script
       uses: ./.github/actions/gradle-command-self-hosted-action
       with:
-        gradle-command: :beam-test-gha:preCommit
\ No newline at end of file
+        gradle-command: :beam-test-gha:preCommit
diff --git a/.github/workflows/beam_PreCommit_Go.yml b/.github/workflows/beam_PreCommit_Go.yml
index 4d64cba3675c..335d531f7435 100644
--- a/.github/workflows/beam_PreCommit_Go.yml
+++ b/.github/workflows/beam_PreCommit_Go.yml
@@ -72,6 +72,8 @@ jobs:
       github.event.comment.body == 'Run Go PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -86,4 +88,4 @@ jobs:
       - name: run goPreCommit script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :goPreCommit
\ No newline at end of file
+          gradle-command: :goPreCommit
diff --git a/.github/workflows/beam_PreCommit_GoPortable.yml b/.github/workflows/beam_PreCommit_GoPortable.yml
index 1d64bb3c23c6..4239555c038b 100644
--- a/.github/workflows/beam_PreCommit_GoPortable.yml
+++ b/.github/workflows/beam_PreCommit_GoPortable.yml
@@ -74,6 +74,8 @@ jobs:
       github.event.comment.body == 'Run GoPortable PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_GoPrism.yml b/.github/workflows/beam_PreCommit_GoPrism.yml
index 6ff29459a047..cac49331592f 100644
--- a/.github/workflows/beam_PreCommit_GoPrism.yml
+++ b/.github/workflows/beam_PreCommit_GoPrism.yml
@@ -72,6 +72,8 @@ jobs:
       github.event.comment.body == 'Run GoPrism PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -86,4 +88,4 @@ jobs:
       - name: Run goPrismPreCommit script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :goPrismPreCommit
\ No newline at end of file
+          gradle-command: :goPrismPreCommit
diff --git a/.github/workflows/beam_PreCommit_ItFramework.yml b/.github/workflows/beam_PreCommit_ItFramework.yml
index dc00bea0ee7c..c0b666a61231 100644
--- a/.github/workflows/beam_PreCommit_ItFramework.yml
+++ b/.github/workflows/beam_PreCommit_ItFramework.yml
@@ -77,6 +77,8 @@ jobs:
       github.event.comment.body == 'Run It_Framework PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PreCommit_Java.yml b/.github/workflows/beam_PreCommit_Java.yml
index b3e89b46218e..543989f8fb39 100644
--- a/.github/workflows/beam_PreCommit_Java.yml
+++ b/.github/workflows/beam_PreCommit_Java.yml
@@ -171,6 +171,8 @@ jobs:
       github.event.comment.body == 'Run Java PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml
index e3fdb9717313..9e9e33ef2888 100644
--- a/.github/workflows/beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml
@@ -95,6 +95,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -142,4 +144,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Amqp_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Amqp_IO_Direct.yml
index 884f1f64667e..aed74b85e7be 100644
--- a/.github/workflows/beam_PreCommit_Java_Amqp_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Amqp_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -116,4 +118,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Azure_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Azure_IO_Direct.yml
index f06c3e6db095..5f7d89c5ea33 100644
--- a/.github/workflows/beam_PreCommit_Java_Azure_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Azure_IO_Direct.yml
@@ -95,6 +95,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -135,4 +137,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Cassandra_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Cassandra_IO_Direct.yml
index c81e712e20af..d0bd861ca585 100644
--- a/.github/workflows/beam_PreCommit_Java_Cassandra_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Cassandra_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Cdap_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Cdap_IO_Direct.yml
index 0367a70b4a3c..8118273ed62f 100644
--- a/.github/workflows/beam_PreCommit_Java_Cdap_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Cdap_IO_Direct.yml
@@ -81,6 +81,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -121,4 +123,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Clickhouse_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Clickhouse_IO_Direct.yml
index 8671235d587a..35c1ec4aeeb5 100644
--- a/.github/workflows/beam_PreCommit_Java_Clickhouse_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Clickhouse_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -124,4 +126,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Csv_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Csv_IO_Direct.yml
index f409ae559582..4d4a72317607 100644
--- a/.github/workflows/beam_PreCommit_Java_Csv_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Csv_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Datadog_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Datadog_IO_Direct.yml
index 48e563c905fc..57233c8a0d69 100644
--- a/.github/workflows/beam_PreCommit_Java_Datadog_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Datadog_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Dataflow.yml b/.github/workflows/beam_PreCommit_Java_Dataflow.yml
index 3e477197f824..febcf9ab3ffd 100644
--- a/.github/workflows/beam_PreCommit_Java_Dataflow.yml
+++ b/.github/workflows/beam_PreCommit_Java_Dataflow.yml
@@ -78,6 +78,8 @@ jobs:
       github.event.comment.body == 'Run Java Dataflow Non-portable Worker PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -132,4 +134,4 @@ jobs:
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v3
         with:
-          flags: java
\ No newline at end of file
+          flags: java
diff --git a/.github/workflows/beam_PreCommit_Java_Debezium_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Debezium_IO_Direct.yml
index 7b839616efac..4b44d8c17544 100644
--- a/.github/workflows/beam_PreCommit_Java_Debezium_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Debezium_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_Delta_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Delta_IO_Direct.yml
index 63439b38bc55..d7624d5ccd36 100644
--- a/.github/workflows/beam_PreCommit_Java_Delta_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Delta_IO_Direct.yml
@@ -83,6 +83,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_ElasticSearch_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_ElasticSearch_IO_Direct.yml
index 67eb433e4db5..bec4fe27e8e9 100644
--- a/.github/workflows/beam_PreCommit_Java_ElasticSearch_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_ElasticSearch_IO_Direct.yml
@@ -79,6 +79,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_Examples_Dataflow.yml b/.github/workflows/beam_PreCommit_Java_Examples_Dataflow.yml
index dd58e8d474f9..7c1286ce418a 100644
--- a/.github/workflows/beam_PreCommit_Java_Examples_Dataflow.yml
+++ b/.github/workflows/beam_PreCommit_Java_Examples_Dataflow.yml
@@ -88,6 +88,8 @@ jobs:
       github.event.comment.body == 'Run Java_Examples_Dataflow PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -119,4 +121,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PreCommit_Java_Examples_Dataflow_Java21.yml b/.github/workflows/beam_PreCommit_Java_Examples_Dataflow_Java21.yml
index 2c4b607a1a5e..0ed049b4628e 100644
--- a/.github/workflows/beam_PreCommit_Java_Examples_Dataflow_Java21.yml
+++ b/.github/workflows/beam_PreCommit_Java_Examples_Dataflow_Java21.yml
@@ -87,6 +87,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup repository
       uses: ./.github/actions/setup-action
       with:
@@ -139,4 +141,4 @@ jobs:
       uses: actions/upload-artifact@v7
       with:
         name: SpotBugs Results
-        path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+        path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_File-schema-transform_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_File-schema-transform_IO_Direct.yml
index 00f42519fd11..3f9223eaba63 100644
--- a/.github/workflows/beam_PreCommit_Java_File-schema-transform_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_File-schema-transform_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -118,4 +120,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Flink_Versions.yml b/.github/workflows/beam_PreCommit_Java_Flink_Versions.yml
index 7308963dc6d3..0b88dcfe6866 100644
--- a/.github/workflows/beam_PreCommit_Java_Flink_Versions.yml
+++ b/.github/workflows/beam_PreCommit_Java_Flink_Versions.yml
@@ -76,6 +76,8 @@ jobs:
       github.event.comment.body == 'Run Java_Flink_Versions PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -105,4 +107,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PreCommit_Java_GCP_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_GCP_IO_Direct.yml
index eb9739c33b59..9ebb56b76d5e 100644
--- a/.github/workflows/beam_PreCommit_Java_GCP_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_GCP_IO_Direct.yml
@@ -95,6 +95,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -153,4 +155,4 @@ jobs:
         uses: codecov/codecov-action@v3
         with:
           file: ${{ steps.jacoco_report_path.outputs.path }}
-          flags: java
\ No newline at end of file
+          flags: java
diff --git a/.github/workflows/beam_PreCommit_Java_Google-ads_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Google-ads_IO_Direct.yml
index 41e857a0ab42..6d6ae12d1d15 100644
--- a/.github/workflows/beam_PreCommit_Java_Google-ads_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Google-ads_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup repository
       uses: ./.github/actions/setup-action
       with:
@@ -115,4 +117,4 @@ jobs:
       if: always()
       with:
         name: Publish SpotBugs
-        path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+        path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_HBase_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_HBase_IO_Direct.yml
index 35d00af9aafd..4f4465cfa371 100644
--- a/.github/workflows/beam_PreCommit_Java_HBase_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_HBase_IO_Direct.yml
@@ -79,6 +79,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -119,4 +121,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_HCatalog_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_HCatalog_IO_Direct.yml
index f8561eb7c856..4be6f7779cb3 100644
--- a/.github/workflows/beam_PreCommit_Java_HCatalog_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_HCatalog_IO_Direct.yml
@@ -79,6 +79,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -119,4 +121,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Hadoop_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Hadoop_IO_Direct.yml
index 6c0e93f37e3d..9b53c6875252 100644
--- a/.github/workflows/beam_PreCommit_Java_Hadoop_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Hadoop_IO_Direct.yml
@@ -103,6 +103,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -157,4 +159,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_IOs_Direct.yml b/.github/workflows/beam_PreCommit_Java_IOs_Direct.yml
index a3af909a9ad6..97af80a18477 100644
--- a/.github/workflows/beam_PreCommit_Java_IOs_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_IOs_Direct.yml
@@ -80,6 +80,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -121,4 +123,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_InfluxDb_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_InfluxDb_IO_Direct.yml
index 84177c33b5af..3ff0d49bd644 100644
--- a/.github/workflows/beam_PreCommit_Java_InfluxDb_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_InfluxDb_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_JDBC_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_JDBC_IO_Direct.yml
index 2ac937a34548..96621b494353 100644
--- a/.github/workflows/beam_PreCommit_Java_JDBC_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_JDBC_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -124,4 +126,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Jms_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Jms_IO_Direct.yml
index 309a316a99a0..3336c214414d 100644
--- a/.github/workflows/beam_PreCommit_Java_Jms_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Jms_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -124,4 +126,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Kafka_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Kafka_IO_Direct.yml
index 39c4b064c863..c9f484b075f8 100644
--- a/.github/workflows/beam_PreCommit_Java_Kafka_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Kafka_IO_Direct.yml
@@ -85,6 +85,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_Kudu_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Kudu_IO_Direct.yml
index a4531c47aede..70617ceffbc8 100644
--- a/.github/workflows/beam_PreCommit_Java_Kudu_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Kudu_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_MongoDb_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_MongoDb_IO_Direct.yml
index 54a512170cf6..afaec9df36f7 100644
--- a/.github/workflows/beam_PreCommit_Java_MongoDb_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_MongoDb_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Mqtt_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Mqtt_IO_Direct.yml
index 0131ea6d7fe0..661cb7b67afc 100644
--- a/.github/workflows/beam_PreCommit_Java_Mqtt_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Mqtt_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Neo4j_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Neo4j_IO_Direct.yml
index 224718385639..97b52e1a52da 100644
--- a/.github/workflows/beam_PreCommit_Java_Neo4j_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Neo4j_IO_Direct.yml
@@ -79,6 +79,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -126,4 +128,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_PVR_Flink_Batch.yml b/.github/workflows/beam_PreCommit_Java_PVR_Flink_Batch.yml
index f4b1b4545e32..4bac198b2da0 100644
--- a/.github/workflows/beam_PreCommit_Java_PVR_Flink_Batch.yml
+++ b/.github/workflows/beam_PreCommit_Java_PVR_Flink_Batch.yml
@@ -83,6 +83,8 @@ jobs:
       github.event.comment.body == 'Run Java_PVR_Flink_Batch PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_PVR_Flink_Docker.yml b/.github/workflows/beam_PreCommit_Java_PVR_Flink_Docker.yml
index a173e38eb47d..5dcddb1beff8 100644
--- a/.github/workflows/beam_PreCommit_Java_PVR_Flink_Docker.yml
+++ b/.github/workflows/beam_PreCommit_Java_PVR_Flink_Docker.yml
@@ -88,6 +88,8 @@ jobs:
     timeout-minutes: 240
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_PVR_Prism_Loopback.yml b/.github/workflows/beam_PreCommit_Java_PVR_Prism_Loopback.yml
index 19be2efc087b..56fcabddc9d7 100644
--- a/.github/workflows/beam_PreCommit_Java_PVR_Prism_Loopback.yml
+++ b/.github/workflows/beam_PreCommit_Java_PVR_Prism_Loopback.yml
@@ -89,6 +89,8 @@ jobs:
       github.event.comment.body == 'Run Java_PVR_Prism_Loopback PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_Parquet_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Parquet_IO_Direct.yml
index cf2d3f6ab203..6e95f71673d1 100644
--- a/.github/workflows/beam_PreCommit_Java_Parquet_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Parquet_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Pulsar_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Pulsar_IO_Direct.yml
index 03a037c87306..ec825890bdc2 100644
--- a/.github/workflows/beam_PreCommit_Java_Pulsar_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Pulsar_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_RabbitMq_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_RabbitMq_IO_Direct.yml
index 3faf5a1a2daf..5770b9f3e552 100644
--- a/.github/workflows/beam_PreCommit_Java_RabbitMq_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_RabbitMq_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Redis_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Redis_IO_Direct.yml
index e38dd57fefda..9441278f83b1 100644
--- a/.github/workflows/beam_PreCommit_Java_Redis_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Redis_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_RequestResponse_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_RequestResponse_IO_Direct.yml
index 15f83fc9dc87..b4e55572ab22 100644
--- a/.github/workflows/beam_PreCommit_Java_RequestResponse_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_RequestResponse_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup repository
       uses: ./.github/actions/setup-action
       with:
@@ -115,4 +117,4 @@ jobs:
       if: always()
       with:
         name: Publish SpotBugs
-        path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+        path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_SingleStore_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_SingleStore_IO_Direct.yml
index 9f552343232a..f7d4347f3ee0 100644
--- a/.github/workflows/beam_PreCommit_Java_SingleStore_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_SingleStore_IO_Direct.yml
@@ -79,6 +79,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -119,4 +121,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Snowflake_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Snowflake_IO_Direct.yml
index b78854779e51..678a0dbff191 100644
--- a/.github/workflows/beam_PreCommit_Java_Snowflake_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Snowflake_IO_Direct.yml
@@ -81,6 +81,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -128,4 +130,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Solace_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Solace_IO_Direct.yml
index e72aa00bdd15..5d387b38b568 100644
--- a/.github/workflows/beam_PreCommit_Java_Solace_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Solace_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup repository
       uses: ./.github/actions/setup-action
       with:
@@ -124,4 +126,4 @@ jobs:
       if: always()
       with:
         name: Publish SpotBugs
-        path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+        path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Solr_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Solr_IO_Direct.yml
index ee2ea171dd4a..6857e142cfba 100644
--- a/.github/workflows/beam_PreCommit_Java_Solr_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Solr_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Spark_Versions.yml b/.github/workflows/beam_PreCommit_Java_Spark_Versions.yml
index 9821419da139..969dd363643d 100644
--- a/.github/workflows/beam_PreCommit_Java_Spark_Versions.yml
+++ b/.github/workflows/beam_PreCommit_Java_Spark_Versions.yml
@@ -79,6 +79,8 @@ jobs:
       github.event.comment.body == 'Run Java_Spark_Versions PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -111,4 +113,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/build/test-results/**/*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PreCommit_Java_Splunk_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Splunk_IO_Direct.yml
index 405e82f4517d..a5140f391d6e 100644
--- a/.github/workflows/beam_PreCommit_Java_Splunk_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Splunk_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Thrift_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Thrift_IO_Direct.yml
index 1286ffcc7816..515184ba5c76 100644
--- a/.github/workflows/beam_PreCommit_Java_Thrift_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Thrift_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Java_Tika_IO_Direct.yml b/.github/workflows/beam_PreCommit_Java_Tika_IO_Direct.yml
index 477397c1e30a..fd4214ad4203 100644
--- a/.github/workflows/beam_PreCommit_Java_Tika_IO_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Java_Tika_IO_Direct.yml
@@ -77,6 +77,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Kotlin_Examples.yml b/.github/workflows/beam_PreCommit_Kotlin_Examples.yml
index 35c3786c00e3..9157e951bfae 100644
--- a/.github/workflows/beam_PreCommit_Kotlin_Examples.yml
+++ b/.github/workflows/beam_PreCommit_Kotlin_Examples.yml
@@ -89,6 +89,8 @@ jobs:
       github.event.comment.body == 'Run Kotlin_Examples PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -102,4 +104,4 @@ jobs:
       - name: run Kotlin Examples script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :examples:kotlin:preCommit
\ No newline at end of file
+          gradle-command: :examples:kotlin:preCommit
diff --git a/.github/workflows/beam_PreCommit_Portable_Python.yml b/.github/workflows/beam_PreCommit_Portable_Python.yml
index 2a616e7dd944..bfc6c2fcb1c1 100644
--- a/.github/workflows/beam_PreCommit_Portable_Python.yml
+++ b/.github/workflows/beam_PreCommit_Portable_Python.yml
@@ -91,6 +91,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Portable_Python PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -113,4 +115,4 @@ jobs:
       - name: run Portable Python script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:python:test-suites:portable:py${{steps.set_py_ver_clean.outputs.py_ver_clean}}:preCommitPy${{steps.set_py_ver_clean.outputs.py_ver_clean}}
\ No newline at end of file
+          gradle-command: :sdks:python:test-suites:portable:py${{steps.set_py_ver_clean.outputs.py_ver_clean}}:preCommitPy${{steps.set_py_ver_clean.outputs.py_ver_clean}}
diff --git a/.github/workflows/beam_PreCommit_Prism_Python.yml b/.github/workflows/beam_PreCommit_Prism_Python.yml
index 4571b5b3c8c8..8a5e2b6433b1 100644
--- a/.github/workflows/beam_PreCommit_Prism_Python.yml
+++ b/.github/workflows/beam_PreCommit_Prism_Python.yml
@@ -85,6 +85,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Prism_Python PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -107,4 +109,4 @@ jobs:
       - name: run Prism Python Validates Runner script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:python:test-suites:portable:py${{steps.set_py_ver_clean.outputs.py_ver_clean}}:prismValidatesRunner
\ No newline at end of file
+          gradle-command: :sdks:python:test-suites:portable:py${{steps.set_py_ver_clean.outputs.py_ver_clean}}:prismValidatesRunner
diff --git a/.github/workflows/beam_PreCommit_Python.yml b/.github/workflows/beam_PreCommit_Python.yml
index d856f011a64a..e897b371b94d 100644
--- a/.github/workflows/beam_PreCommit_Python.yml
+++ b/.github/workflows/beam_PreCommit_Python.yml
@@ -92,6 +92,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_PythonDocker.yml b/.github/workflows/beam_PreCommit_PythonDocker.yml
index ca950aac2116..f413e82d6cb5 100644
--- a/.github/workflows/beam_PreCommit_PythonDocker.yml
+++ b/.github/workflows/beam_PreCommit_PythonDocker.yml
@@ -70,6 +70,8 @@ jobs:
       (github.event_name == 'schedule' && github.repository == 'apache/beam')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_PythonDocs.yml b/.github/workflows/beam_PreCommit_PythonDocs.yml
index 9d7caa15f858..1a32212705d6 100644
--- a/.github/workflows/beam_PreCommit_PythonDocs.yml
+++ b/.github/workflows/beam_PreCommit_PythonDocs.yml
@@ -72,6 +72,8 @@ jobs:
       github.event.comment.body == 'Run PythonDocs PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_PythonFormatter.yml b/.github/workflows/beam_PreCommit_PythonFormatter.yml
index bbc04512c80d..5b052d9376a8 100644
--- a/.github/workflows/beam_PreCommit_PythonFormatter.yml
+++ b/.github/workflows/beam_PreCommit_PythonFormatter.yml
@@ -71,6 +71,8 @@ jobs:
       github.event.comment.body == 'Run PythonFormatter PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_PythonLint.yml b/.github/workflows/beam_PreCommit_PythonLint.yml
index f4c15b5a0115..637470db711f 100644
--- a/.github/workflows/beam_PreCommit_PythonLint.yml
+++ b/.github/workflows/beam_PreCommit_PythonLint.yml
@@ -71,6 +71,8 @@ jobs:
       github.event.comment.body == 'Run PythonLint PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Python_Coverage.yml b/.github/workflows/beam_PreCommit_Python_Coverage.yml
index 4799c1e7b09e..17bc17e33c15 100644
--- a/.github/workflows/beam_PreCommit_Python_Coverage.yml
+++ b/.github/workflows/beam_PreCommit_Python_Coverage.yml
@@ -75,6 +75,8 @@ jobs:
       startswith(github.event.comment.body, 'Run Python_Coverage PreCommit 3.')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Python_Dataframes.yml b/.github/workflows/beam_PreCommit_Python_Dataframes.yml
index f80b8c0d298a..95515c729644 100644
--- a/.github/workflows/beam_PreCommit_Python_Dataframes.yml
+++ b/.github/workflows/beam_PreCommit_Python_Dataframes.yml
@@ -73,6 +73,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python_Dataframes PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -110,4 +112,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PreCommit_Python_Dill.yml b/.github/workflows/beam_PreCommit_Python_Dill.yml
index 6a807bda69c1..f5f7c937beda 100644
--- a/.github/workflows/beam_PreCommit_Python_Dill.yml
+++ b/.github/workflows/beam_PreCommit_Python_Dill.yml
@@ -82,6 +82,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python_Dill PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Python_Examples.yml b/.github/workflows/beam_PreCommit_Python_Examples.yml
index c8608a1909ff..d4ddb18cbe30 100644
--- a/.github/workflows/beam_PreCommit_Python_Examples.yml
+++ b/.github/workflows/beam_PreCommit_Python_Examples.yml
@@ -74,6 +74,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python_Examples PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Python_Integration.yml b/.github/workflows/beam_PreCommit_Python_Integration.yml
index 22a334ee442d..0aa813a673db 100644
--- a/.github/workflows/beam_PreCommit_Python_Integration.yml
+++ b/.github/workflows/beam_PreCommit_Python_Integration.yml
@@ -73,6 +73,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python_Integration PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -117,4 +119,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PreCommit_Python_ML.yml b/.github/workflows/beam_PreCommit_Python_ML.yml
index 568ae36c1bef..b9b6a9df687a 100644
--- a/.github/workflows/beam_PreCommit_Python_ML.yml
+++ b/.github/workflows/beam_PreCommit_Python_ML.yml
@@ -88,6 +88,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python_ML PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Free Disk Space (Ubuntu)
         if: contains(matrix.os, 'ubuntu-latest')
         uses: jlumbroso/free-disk-space@v1.3.1
diff --git a/.github/workflows/beam_PreCommit_Python_PVR_Flink.yml b/.github/workflows/beam_PreCommit_Python_PVR_Flink.yml
index 2125eb41bfb3..3b4b6acf7334 100644
--- a/.github/workflows/beam_PreCommit_Python_PVR_Flink.yml
+++ b/.github/workflows/beam_PreCommit_Python_PVR_Flink.yml
@@ -91,6 +91,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Python_Runners.yml b/.github/workflows/beam_PreCommit_Python_Runners.yml
index 70d9ed4cd02f..c04c7736c5fd 100644
--- a/.github/workflows/beam_PreCommit_Python_Runners.yml
+++ b/.github/workflows/beam_PreCommit_Python_Runners.yml
@@ -73,6 +73,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python_Runners PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -110,4 +112,4 @@ jobs:
           commit: '${{ env.prsha || env.GITHUB_SHA }}'
           comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
           files: '**/pytest*.xml'
-          large_files: true
\ No newline at end of file
+          large_files: true
diff --git a/.github/workflows/beam_PreCommit_Python_Transforms.yml b/.github/workflows/beam_PreCommit_Python_Transforms.yml
index 24c86947abce..22ad88300085 100644
--- a/.github/workflows/beam_PreCommit_Python_Transforms.yml
+++ b/.github/workflows/beam_PreCommit_Python_Transforms.yml
@@ -74,6 +74,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Python_Transforms PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_RAT.yml b/.github/workflows/beam_PreCommit_RAT.yml
index a8fc9ce32b3c..66c17ce082a3 100644
--- a/.github/workflows/beam_PreCommit_RAT.yml
+++ b/.github/workflows/beam_PreCommit_RAT.yml
@@ -70,6 +70,8 @@ jobs:
       github.event.comment.body == 'Run RAT PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_SQL.yml b/.github/workflows/beam_PreCommit_SQL.yml
index 7f4cd810ffd7..339cc016c636 100644
--- a/.github/workflows/beam_PreCommit_SQL.yml
+++ b/.github/workflows/beam_PreCommit_SQL.yml
@@ -72,6 +72,8 @@ jobs:
       github.event.comment.body == 'Run SQL PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -129,4 +131,4 @@ jobs:
         uses: codecov/codecov-action@v3
         with:
           file: ${{ steps.jacoco_report_path.outputs.path }}
-          flags: java
\ No newline at end of file
+          flags: java
diff --git a/.github/workflows/beam_PreCommit_SQL_Java17.yml b/.github/workflows/beam_PreCommit_SQL_Java17.yml
index ddd508e79e29..48822a1404f2 100644
--- a/.github/workflows/beam_PreCommit_SQL_Java17.yml
+++ b/.github/workflows/beam_PreCommit_SQL_Java17.yml
@@ -72,6 +72,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -122,4 +124,4 @@ jobs:
         if: always()
         with:
           name: Publish SpotBugs
-          path: '**/build/reports/spotbugs/*.html'
\ No newline at end of file
+          path: '**/build/reports/spotbugs/*.html'
diff --git a/.github/workflows/beam_PreCommit_Spotless.yml b/.github/workflows/beam_PreCommit_Spotless.yml
index 64701930e856..003d5754a7da 100644
--- a/.github/workflows/beam_PreCommit_Spotless.yml
+++ b/.github/workflows/beam_PreCommit_Spotless.yml
@@ -77,6 +77,8 @@ jobs:
       github.event.comment.body == 'Run Spotless PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -99,4 +101,4 @@ jobs:
         uses: jwgmeligmeyling/checkstyle-github-action@v1
         if: always()
         with:
-          path: '**/build/reports/checkstyle/*.xml'
\ No newline at end of file
+          path: '**/build/reports/checkstyle/*.xml'
diff --git a/.github/workflows/beam_PreCommit_Typescript.yml b/.github/workflows/beam_PreCommit_Typescript.yml
index a20f96f79105..4fef4386e816 100644
--- a/.github/workflows/beam_PreCommit_Typescript.yml
+++ b/.github/workflows/beam_PreCommit_Typescript.yml
@@ -73,6 +73,8 @@ jobs:
       github.event.comment.body == 'Run Typescript PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -87,4 +89,4 @@ jobs:
       - name: run typescriptPreCommit script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :typescriptPreCommit
\ No newline at end of file
+          gradle-command: :typescriptPreCommit
diff --git a/.github/workflows/beam_PreCommit_Website.yml b/.github/workflows/beam_PreCommit_Website.yml
index 59718f02c7b1..c8fb87130743 100644
--- a/.github/workflows/beam_PreCommit_Website.yml
+++ b/.github/workflows/beam_PreCommit_Website.yml
@@ -72,6 +72,8 @@ jobs:
       github.event.comment.body == 'Run Website PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -85,4 +87,4 @@ jobs:
       - name: run websitePreCommit script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :websitePreCommit
\ No newline at end of file
+          gradle-command: :websitePreCommit
diff --git a/.github/workflows/beam_PreCommit_Website_Stage_GCS.yml b/.github/workflows/beam_PreCommit_Website_Stage_GCS.yml
index 0fdfe3974bb4..8d90f76c6a14 100644
--- a/.github/workflows/beam_PreCommit_Website_Stage_GCS.yml
+++ b/.github/workflows/beam_PreCommit_Website_Stage_GCS.yml
@@ -74,6 +74,8 @@ jobs:
       github.event.comment.body == 'Run Website_Stage_GCS PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Whitespace.yml b/.github/workflows/beam_PreCommit_Whitespace.yml
index a1f6beb7a623..6b95073dc3a0 100644
--- a/.github/workflows/beam_PreCommit_Whitespace.yml
+++ b/.github/workflows/beam_PreCommit_Whitespace.yml
@@ -71,6 +71,8 @@ jobs:
       github.event.comment.body == 'Run Whitespace PreCommit'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Xlang_Generated_Transforms.yml b/.github/workflows/beam_PreCommit_Xlang_Generated_Transforms.yml
index df4162ec984c..f2e5e8fd139a 100644
--- a/.github/workflows/beam_PreCommit_Xlang_Generated_Transforms.yml
+++ b/.github/workflows/beam_PreCommit_Xlang_Generated_Transforms.yml
@@ -93,6 +93,8 @@ jobs:
       startsWith(github.event.comment.body, 'Run Xlang_Generated_Transforms PreCommit')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Yaml_Xlang_Direct.yml b/.github/workflows/beam_PreCommit_Yaml_Xlang_Direct.yml
index e3dd78460734..5af479707bd5 100644
--- a/.github/workflows/beam_PreCommit_Yaml_Xlang_Direct.yml
+++ b/.github/workflows/beam_PreCommit_Yaml_Xlang_Direct.yml
@@ -79,6 +79,8 @@ jobs:
         job_phrase: ["Run Yaml_Xlang_Direct PreCommit"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_Prober_CommunityMetrics.yml b/.github/workflows/beam_Prober_CommunityMetrics.yml
index abe9e0e4e974..d4f055eb13ae 100644
--- a/.github/workflows/beam_Prober_CommunityMetrics.yml
+++ b/.github/workflows/beam_Prober_CommunityMetrics.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Community Metrics Prober"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -76,4 +78,4 @@ jobs:
         with:
           gradle-command: :communityMetricsProber
           arguments: |
-            --rerun-tasks
\ No newline at end of file
+            --rerun-tasks
diff --git a/.github/workflows/beam_Publish_BeamMetrics.yml b/.github/workflows/beam_Publish_BeamMetrics.yml
index 111913692feb..99c47429892a 100644
--- a/.github/workflows/beam_Publish_BeamMetrics.yml
+++ b/.github/workflows/beam_Publish_BeamMetrics.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Beam Metrics Deployment"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml b/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml
index 8ffd35c06baa..d9a4d83bb50f 100644
--- a/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml
+++ b/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml
@@ -75,6 +75,8 @@ jobs:
           - "java:expansion-service:container:docker"
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.1
       - name: Setup repository
diff --git a/.github/workflows/beam_Publish_Docker_Snapshots.yml b/.github/workflows/beam_Publish_Docker_Snapshots.yml
index c8251c3d913e..414901df944a 100644
--- a/.github/workflows/beam_Publish_Docker_Snapshots.yml
+++ b/.github/workflows/beam_Publish_Docker_Snapshots.yml
@@ -62,6 +62,8 @@ jobs:
         job_phrase: ["Publish Docker Snapshots"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_Publish_Python_VLLM_Image.yml b/.github/workflows/beam_Publish_Python_VLLM_Image.yml
index 21b6dc8d53c8..38d331af290d 100644
--- a/.github/workflows/beam_Publish_Python_VLLM_Image.yml
+++ b/.github/workflows/beam_Publish_Python_VLLM_Image.yml
@@ -53,6 +53,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Authenticate on GCP
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
         with:
diff --git a/.github/workflows/beam_Publish_Website.yml b/.github/workflows/beam_Publish_Website.yml
index 4420878bd280..719ffd6b7940 100644
--- a/.github/workflows/beam_Publish_Website.yml
+++ b/.github/workflows/beam_Publish_Website.yml
@@ -54,6 +54,8 @@ jobs:
     name: beam_Publish_Website
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
@@ -70,3 +72,5 @@ jobs:
           gradle-command: :website:clean :website:publishWebsite
           arguments: -PgitPublishRemote="https://github.com/apache/beam.git" -PgcpCredsFile="${{ steps.auth-gcp.outputs.credentials_file_path }}"
       - uses: actions/checkout@v7 # Extra checkout to make sure we're on master for post steps.
+        with:
+          persist-credentials: false
diff --git a/.github/workflows/beam_Python_CostBenchmarks_Dataflow.yml b/.github/workflows/beam_Python_CostBenchmarks_Dataflow.yml
index 3a904db7d32e..2752d879cbd3 100644
--- a/.github/workflows/beam_Python_CostBenchmarks_Dataflow.yml
+++ b/.github/workflows/beam_Python_CostBenchmarks_Dataflow.yml
@@ -62,6 +62,8 @@ jobs:
         job_phrase: ["Run Python Dataflow Cost Benchmarks"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -104,4 +106,4 @@ jobs:
             -Prunner=DataflowRunner \
             -PpythonVersion=3.10 \
             -PloadTest.requirementsTxtFile=apache_beam/ml/inference/tensorflow_tests_requirements.txt \
-            '-PloadTest.args=${{ env.beam_Python_Cost_Benchmarks_Dataflow_test_arguments_2 }} --job_name=benchmark-tests-tf-mnist-classification-python-${{env.NOW_UTC}} --input_file=gs://apache-beam-ml/testing/inputs/it_mnist_data.csv --output_file=gs://temp-storage-for-end-to-end-tests/inference/result_tf_mnist-${{env.NOW_UTC}}.txt --model=gs://apache-beam-ml/models/tensorflow/mnist/' \
\ No newline at end of file
+            '-PloadTest.args=${{ env.beam_Python_Cost_Benchmarks_Dataflow_test_arguments_2 }} --job_name=benchmark-tests-tf-mnist-classification-python-${{env.NOW_UTC}} --input_file=gs://apache-beam-ml/testing/inputs/it_mnist_data.csv --output_file=gs://temp-storage-for-end-to-end-tests/inference/result_tf_mnist-${{env.NOW_UTC}}.txt --model=gs://apache-beam-ml/models/tensorflow/mnist/' \
diff --git a/.github/workflows/beam_Python_ValidatesContainer_Dataflow_ARM.yml b/.github/workflows/beam_Python_ValidatesContainer_Dataflow_ARM.yml
index 19c506c93ebe..a02d17ea22ac 100644
--- a/.github/workflows/beam_Python_ValidatesContainer_Dataflow_ARM.yml
+++ b/.github/workflows/beam_Python_ValidatesContainer_Dataflow_ARM.yml
@@ -64,6 +64,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.1
       - name: Setup repository
diff --git a/.github/workflows/beam_Release_NightlySnapshot.yml b/.github/workflows/beam_Release_NightlySnapshot.yml
index 012d46907f4d..c9c41fd9ebc1 100644
--- a/.github/workflows/beam_Release_NightlySnapshot.yml
+++ b/.github/workflows/beam_Release_NightlySnapshot.yml
@@ -52,6 +52,8 @@ jobs:
       (github.event_name == 'schedule' && github.repository == 'apache/beam')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_Release_Python_NightlySnapshot.yml b/.github/workflows/beam_Release_Python_NightlySnapshot.yml
index e0c3ffd93011..51537049f7a5 100644
--- a/.github/workflows/beam_Release_Python_NightlySnapshot.yml
+++ b/.github/workflows/beam_Release_Python_NightlySnapshot.yml
@@ -54,6 +54,8 @@ jobs:
       (github.event_name == 'schedule' && github.repository == 'apache/beam')
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -77,4 +79,4 @@ jobs:
         run: |
           bash sdks/python/scripts/run_snapshot_publish.sh
         env:
-          WORKSPACE: ${{ github.workspace }}
\ No newline at end of file
+          WORKSPACE: ${{ github.workspace }}
diff --git a/.github/workflows/beam_StressTests_Java_BigQueryIO.yml b/.github/workflows/beam_StressTests_Java_BigQueryIO.yml
index c2bdbd465568..8f1ef8f034ac 100644
--- a/.github/workflows/beam_StressTests_Java_BigQueryIO.yml
+++ b/.github/workflows/beam_StressTests_Java_BigQueryIO.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Stress Tests Java BigQueryIO"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -74,4 +76,4 @@ jobs:
       - name: run BigQuery StressTest Large
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :it:google-cloud-platform:BigQueryStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_bigquery"
\ No newline at end of file
+          gradle-command: :it:google-cloud-platform:BigQueryStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_bigquery"
diff --git a/.github/workflows/beam_StressTests_Java_BigTableIO.yml b/.github/workflows/beam_StressTests_Java_BigTableIO.yml
index 2e5eb3a4ebdc..1ddb10e84439 100644
--- a/.github/workflows/beam_StressTests_Java_BigTableIO.yml
+++ b/.github/workflows/beam_StressTests_Java_BigTableIO.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Stress Tests Java BigTableIO"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -74,4 +76,4 @@ jobs:
       - name: run BigTable StressTest Large
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :it:google-cloud-platform:BigTableStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_bigtable"
\ No newline at end of file
+          gradle-command: :it:google-cloud-platform:BigTableStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_bigtable"
diff --git a/.github/workflows/beam_StressTests_Java_KafkaIO.yml b/.github/workflows/beam_StressTests_Java_KafkaIO.yml
index b1ed4c8d5801..9710f36daca2 100644
--- a/.github/workflows/beam_StressTests_Java_KafkaIO.yml
+++ b/.github/workflows/beam_StressTests_Java_KafkaIO.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Stress Tests Java KafkaIO"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
diff --git a/.github/workflows/beam_StressTests_Java_PubSubIO.yml b/.github/workflows/beam_StressTests_Java_PubSubIO.yml
index ed911e128092..c599058f28cd 100644
--- a/.github/workflows/beam_StressTests_Java_PubSubIO.yml
+++ b/.github/workflows/beam_StressTests_Java_PubSubIO.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Stress Tests Java PubSubIO"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -74,4 +76,4 @@ jobs:
       - name: run PubSub StressTest Large
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :it:google-cloud-platform:PubSubStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_pubsub"
\ No newline at end of file
+          gradle-command: :it:google-cloud-platform:PubSubStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_pubsub"
diff --git a/.github/workflows/beam_StressTests_Java_SpannerIO.yml b/.github/workflows/beam_StressTests_Java_SpannerIO.yml
index 3f56af490d77..3f53c335799c 100644
--- a/.github/workflows/beam_StressTests_Java_SpannerIO.yml
+++ b/.github/workflows/beam_StressTests_Java_SpannerIO.yml
@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Stress Tests Java SpannerIO"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -74,4 +76,4 @@ jobs:
       - name: run Spanner StressTest Large
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :it:google-cloud-platform:SpannerStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_spanner"
\ No newline at end of file
+          gradle-command: :it:google-cloud-platform:SpannerStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_spanner"
diff --git a/.github/workflows/build_release_candidate.yml b/.github/workflows/build_release_candidate.yml
index 3f9aa95ede15..7575b306c30b 100644
--- a/.github/workflows/build_release_candidate.yml
+++ b/.github/workflows/build_release_candidate.yml
@@ -65,6 +65,7 @@ jobs:
         with:
           ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
           repository: apache/beam
+          persist-credentials: false
       - name: Install Java 11
         uses: actions/setup-java@v4
         with:
@@ -97,7 +98,9 @@ jobs:
       - name: Configure git
         run: git config credential.helper store
       - name: Stage Java Artifacts into Maven
-        run: ./gradlew publish -Psigning.gnupg.keyName=${{steps.import_gpg.outputs.fingerprint}} -PisRelease -Pjava21Home=$JAVA_HOME_21_X64 --no-daemon --no-parallel
+        run: ./gradlew publish -Psigning.gnupg.keyName=${STEPS_IMPORT_GPG_OUTPUTS_FINGERPRINT} -PisRelease -Pjava21Home=$JAVA_HOME_21_X64 --no-daemon --no-parallel
+        env:
+          STEPS_IMPORT_GPG_OUTPUTS_FINGERPRINT: ${{steps.import_gpg.outputs.fingerprint}}
 
 
   stage_java_source:
@@ -111,14 +114,17 @@ jobs:
           echo "::add-mask::$APACHE_PASS"
       - name: Validate apache id/password
         run: |
-          if [ "${{ github.event.inputs.APACHE_ID }}" == "" ]
+          if [ "${GITHUB_EVENT_INPUTS_APACHE_ID}" == "" ]
           then
             echo "Must provide an apache id to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
           fi
-          if [ "${{ github.event.inputs.APACHE_PASSWORD }}" == "" ]
+          if [ "${GITHUB_EVENT_INPUTS_APACHE_PASSWORD}" == "" ]
           then
             echo "Must provide an apache password to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
           fi
+        env:
+          GITHUB_EVENT_INPUTS_APACHE_ID: ${{ github.event.inputs.APACHE_ID }}
+          GITHUB_EVENT_INPUTS_APACHE_PASSWORD: ${{ github.event.inputs.APACHE_PASSWORD }}
       - name: Install Java 11
         uses: actions/setup-java@v4
         with:
@@ -132,13 +138,13 @@ jobs:
       - name: stage source
         run: |
             svn co https://dist.apache.org/repos/dist/dev/beam
-            mkdir -p beam/${{ github.event.inputs.RELEASE }}
-            cd beam/${{ github.event.inputs.RELEASE }}
-            RC_DIR="beam-${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
+            mkdir -p beam/${GITHUB_EVENT_INPUTS_RELEASE}
+            cd beam/${GITHUB_EVENT_INPUTS_RELEASE}
+            RC_DIR="beam-${GITHUB_EVENT_INPUTS_RELEASE}-RC${GITHUB_EVENT_INPUTS_RC}"
             RC_ZIP="${RC_DIR}.zip"
-            RELEASE_DIR="beam-${{ github.event.inputs.RELEASE }}"
-            RC_TAG="v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
-            SOURCE_RELEASE_ZIP="apache-beam-${{ github.event.inputs.RELEASE }}-source-release.zip"
+            RELEASE_DIR="beam-${GITHUB_EVENT_INPUTS_RELEASE}"
+            RC_TAG="v${GITHUB_EVENT_INPUTS_RELEASE}-RC${GITHUB_EVENT_INPUTS_RC}"
+            SOURCE_RELEASE_ZIP="apache-beam-${GITHUB_EVENT_INPUTS_RELEASE}-source-release.zip"
               # Check whether there is an existing dist dir
             if (svn ls "${SOURCE_RELEASE_ZIP}"); then
               echo "Removing existing ${SOURCE_RELEASE_ZIP}."
@@ -155,14 +161,20 @@ jobs:
             rm -r "$RELEASE_DIR"
 
             echo "----Signing Source Release ${SOURCE_RELEASE_ZIP}-----"
-            gpg --local-user "${{steps.import_gpg.outputs.name}}" --armor --batch --yes --detach-sig "${SOURCE_RELEASE_ZIP}"
+            gpg --local-user "${STEPS_IMPORT_GPG_OUTPUTS_NAME}" --armor --batch --yes --detach-sig "${SOURCE_RELEASE_ZIP}"
 
             echo "----Creating Hash Value for ${SOURCE_RELEASE_ZIP}----"
             sha512sum ${SOURCE_RELEASE_ZIP} > ${SOURCE_RELEASE_ZIP}.sha512
 
             svn add --force .
             svn status
-            svn commit -m "Staging Java artifacts for Apache Beam ${{ github.event.inputs.RELEASE }} RC${{ github.event.inputs.RC }}" --non-interactive --username "${{ github.event.inputs.APACHE_ID }}" --password "${{ github.event.inputs.APACHE_PASSWORD }}"
+            svn commit -m "Staging Java artifacts for Apache Beam ${GITHUB_EVENT_INPUTS_RELEASE} RC${GITHUB_EVENT_INPUTS_RC}" --non-interactive --username "${GITHUB_EVENT_INPUTS_APACHE_ID}" --password "${GITHUB_EVENT_INPUTS_APACHE_PASSWORD}"
+        env:
+          GITHUB_EVENT_INPUTS_RELEASE: ${{ github.event.inputs.RELEASE }}
+          GITHUB_EVENT_INPUTS_RC: ${{ github.event.inputs.RC }}
+          STEPS_IMPORT_GPG_OUTPUTS_NAME: ${{steps.import_gpg.outputs.name}}
+          GITHUB_EVENT_INPUTS_APACHE_ID: ${{ github.event.inputs.APACHE_ID }}
+          GITHUB_EVENT_INPUTS_APACHE_PASSWORD: ${{ github.event.inputs.APACHE_PASSWORD }}
 
   stage_python_artifacts:
     if:  ${{ fromJson(github.event.inputs.STAGE).python_artifacts == 'yes'}}
@@ -171,6 +183,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Mask Apache Password
         run: |
           # Workaround for Actions bug - https://github.com/actions/runner/issues/643
@@ -178,14 +192,17 @@ jobs:
           echo "::add-mask::$APACHE_PASS"
       - name: Mask apache id/password
         run: |
-          if [ "${{ github.event.inputs.APACHE_ID }}" == "" ]
+          if [ "${GITHUB_EVENT_INPUTS_APACHE_ID}" == "" ]
           then
             echo "Must provide an apache id to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
           fi
-          if [ "${{ github.event.inputs.APACHE_PASSWORD }}" == "" ]
+          if [ "${GITHUB_EVENT_INPUTS_APACHE_PASSWORD}" == "" ]
           then
             echo "Must provide an apache password to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
           fi
+        env:
+          GITHUB_EVENT_INPUTS_APACHE_ID: ${{ github.event.inputs.APACHE_ID }}
+          GITHUB_EVENT_INPUTS_APACHE_PASSWORD: ${{ github.event.inputs.APACHE_PASSWORD }}
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
@@ -209,6 +226,9 @@ jobs:
           SCRIPT_DIR: release/src/main/scripts
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SVN_ARTIFACTS_DIR: "beam/${{ github.event.inputs.RELEASE }}/python"
+          STEPS_IMPORT_GPG_OUTPUTS_NAME: ${{steps.import_gpg.outputs.name}}
+          GITHUB_EVENT_INPUTS_APACHE_ID: ${{ github.event.inputs.APACHE_ID }}
+          GITHUB_EVENT_INPUTS_APACHE_PASSWORD: ${{ github.event.inputs.APACHE_PASSWORD }}
         run: |
           svn co https://dist.apache.org/repos/dist/dev/beam
           mkdir -p "${SVN_ARTIFACTS_DIR}"
@@ -231,7 +251,7 @@ jobs:
           sha512sum -c "apache_beam-${RELEASE}.tar.gz.sha512"
 
           echo "------Signing Source Release apache_beam-${RELEASE}.tar.gz------"
-          gpg --local-user "${{steps.import_gpg.outputs.name}}" --armor --detach-sig "apache_beam-${RELEASE}.tar.gz"
+          gpg --local-user "${STEPS_IMPORT_GPG_OUTPUTS_NAME}" --armor --detach-sig "apache_beam-${RELEASE}.tar.gz"
 
           for artifact in *.whl; do
             echo "----------Checking Hash Value for ${artifact} wheel-----------"
@@ -240,13 +260,13 @@ jobs:
 
           for artifact in *.whl; do
             echo "------------------Signing ${artifact} wheel-------------------"
-            gpg --local-user "${{steps.import_gpg.outputs.name}}" --armor --batch --yes --detach-sig "${artifact}"
+            gpg --local-user "${STEPS_IMPORT_GPG_OUTPUTS_NAME}" --armor --batch --yes --detach-sig "${artifact}"
           done
 
           cd ..
           svn add --force python
           svn status
-          svn commit -m "Staging Python artifacts for Apache Beam ${RELEASE} RC${RC_NUM}" --non-interactive --username "${{ github.event.inputs.APACHE_ID }}" --password "${{ github.event.inputs.APACHE_PASSWORD }}"
+          svn commit -m "Staging Python artifacts for Apache Beam ${RELEASE} RC${RC_NUM}" --non-interactive --username "${GITHUB_EVENT_INPUTS_APACHE_ID}" --password "${GITHUB_EVENT_INPUTS_APACHE_PASSWORD}"
 
 
   stage_docker:
@@ -274,6 +294,7 @@ jobs:
         with:
           ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
           repository: apache/beam
+          persist-credentials: false
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.1
       - name: Install Java
@@ -300,7 +321,10 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Push docker images
-        run: ./gradlew ${{ matrix.images_to_publish.gradle_task }} -PisRelease -Pdocker-pull-licenses -Pprune-images ${{ matrix.images_to_publish.include_skip_flags }} -Pdocker-tag=${{ github.event.inputs.RELEASE }}rc${{ github.event.inputs.RC }} --no-daemon --no-parallel
+        run: ./gradlew ${{ matrix.images_to_publish.gradle_task }} -PisRelease -Pdocker-pull-licenses -Pprune-images ${{ matrix.images_to_publish.include_skip_flags }} -Pdocker-tag=${GITHUB_EVENT_INPUTS_RELEASE}rc${GITHUB_EVENT_INPUTS_RC} --no-daemon --no-parallel
+        env:
+          GITHUB_EVENT_INPUTS_RELEASE: ${{ github.event.inputs.RELEASE }}
+          GITHUB_EVENT_INPUTS_RC: ${{ github.event.inputs.RC }}
 
   beam_site_pr:
     if:  ${{ fromJson(github.event.inputs.STAGE).beam_site_pr == 'yes'}}
@@ -322,6 +346,7 @@ jobs:
           ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
           repository: apache/beam
           path: beam
+          persist-credentials: false
       - name: Checkout Beam Site Repo
         uses: actions/checkout@v7
         with:
@@ -329,6 +354,7 @@ jobs:
           path: beam-site
           token: ${{ github.event.inputs.REPO_TOKEN }}
           ref: release-docs
+          persist-credentials: false
       - name: Install Python 3.10
         uses: actions/setup-python@v5
         with:
@@ -382,31 +408,33 @@ jobs:
             git checkout -b $BRANCH_NAME release-docs
 
             echo "..........Copying generated javadoc into beam-site.........."
-            cp -r ${BEAM_ROOT_DIR}/sdks/java/javadoc/build/docs/javadoc/ javadoc/${{ github.event.inputs.RELEASE }}
+            cp -r ${BEAM_ROOT_DIR}/sdks/java/javadoc/build/docs/javadoc/ javadoc/${GITHUB_EVENT_INPUTS_RELEASE}
             # Update current symlink to point to the latest release
             unlink javadoc/current
-            ln -s ${{ github.event.inputs.RELEASE }} javadoc/current
+            ln -s ${GITHUB_EVENT_INPUTS_RELEASE} javadoc/current
 
             echo "............Copying generated pydoc into beam-site.........."
-            cp -r ${BEAM_ROOT_DIR}/sdks/python/target/docs/_build pydoc/${{  github.event.inputs.RELEASE }}
+            cp -r ${BEAM_ROOT_DIR}/sdks/python/target/docs/_build pydoc/${GITHUB_EVENT_INPUTS_RELEASE}
             # Update current symlink to point to the latest release
             unlink pydoc/current
-            ln -s ${{ github.event.inputs.RELEASE }} pydoc/current
+            ln -s ${GITHUB_EVENT_INPUTS_RELEASE} pydoc/current
 
             echo "............Copying generated typedoc into beam-site.........."
             mkdir -p typedoc
-            cp -r ${BEAM_ROOT_DIR}/sdks/typescript/docs typedoc/${{ github.event.inputs.RELEASE }}
+            cp -r ${BEAM_ROOT_DIR}/sdks/typescript/docs typedoc/${GITHUB_EVENT_INPUTS_RELEASE}
             # Update current symlink to point to the latest release
             unlink typedoc/current | true
-            ln -s ${{ github.event.inputs.RELEASE }} typedoc/current
+            ln -s ${GITHUB_EVENT_INPUTS_RELEASE} typedoc/current
 
             echo "............Copying generated yamldoc into beam-site.........."
-            mkdir -p yamldoc/${{ github.event.inputs.RELEASE }}
-            cp -r ${BEAM_ROOT_DIR}/sdks/python/build/yaml-ref.html yamldoc/${{ github.event.inputs.RELEASE }}/index.html
-            cp -r ${BEAM_ROOT_DIR}/sdks/python/build/yaml-examples.html yamldoc/${{ github.event.inputs.RELEASE }}/examples.html
+            mkdir -p yamldoc/${GITHUB_EVENT_INPUTS_RELEASE}
+            cp -r ${BEAM_ROOT_DIR}/sdks/python/build/yaml-ref.html yamldoc/${GITHUB_EVENT_INPUTS_RELEASE}/index.html
+            cp -r ${BEAM_ROOT_DIR}/sdks/python/build/yaml-examples.html yamldoc/${GITHUB_EVENT_INPUTS_RELEASE}/examples.html
             # Update current symlink to point to the latest release
             unlink yamldoc/current | true
-            ln -s ${{ github.event.inputs.RELEASE }} yamldoc/current
+            ln -s ${GITHUB_EVENT_INPUTS_RELEASE} yamldoc/current
+        env:
+          GITHUB_EVENT_INPUTS_RELEASE: ${{ github.event.inputs.RELEASE }}
       - name: Create commit on beam-site branch
         working-directory: beam
         run: |
@@ -416,8 +444,10 @@ jobs:
             git config user.name $GITHUB_ACTOR
             git config user.email actions@"$RUNNER_NAME".local
             git add -A
-            git commit -m "Update beam-site for release ${{ github.event.inputs.RELEASE }}." -m "Content generated from commit ${RELEASE_COMMIT}."
+            git commit -m "Update beam-site for release ${GITHUB_EVENT_INPUTS_RELEASE}." -m "Content generated from commit ${RELEASE_COMMIT}."
             git push -f --set-upstream origin $BRANCH_NAME
+        env:
+          GITHUB_EVENT_INPUTS_RELEASE: ${{ github.event.inputs.RELEASE }}
       - name: Create beam-site PR
         working-directory: beam-site
         env:
@@ -437,6 +467,7 @@ jobs:
         with:
           ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
           repository: apache/beam
+          persist-credentials: false
       - name: Mask Apache Password
         run: |
           # Workaround for Actions bug - https://github.com/actions/runner/issues/643
@@ -444,14 +475,17 @@ jobs:
           echo "::add-mask::$APACHE_PASS"
       - name: Mask apache id/password
         run: |
-          if [ "${{ github.event.inputs.APACHE_ID }}" == "" ]
+          if [ "${GITHUB_EVENT_INPUTS_APACHE_ID}" == "" ]
           then
             echo "Must provide an apache id to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
           fi
-          if [ "${{ github.event.inputs.APACHE_PASSWORD }}" == "" ]
+          if [ "${GITHUB_EVENT_INPUTS_APACHE_PASSWORD}" == "" ]
           then
             echo "Must provide an apache password to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
           fi
+        env:
+          GITHUB_EVENT_INPUTS_APACHE_ID: ${{ github.event.inputs.APACHE_ID }}
+          GITHUB_EVENT_INPUTS_APACHE_PASSWORD: ${{ github.event.inputs.APACHE_PASSWORD }}
       - uses: actions/setup-go@v6
         with:
           go-version: '1.26'
@@ -468,6 +502,9 @@ jobs:
           RELEASE: "${{ github.event.inputs.RELEASE }}"
           GH_TOKEN: ${{ github.event.inputs.REPO_TOKEN  }}
           SVN_ARTIFACTS_DIR: "beam/${{ github.event.inputs.RELEASE }}/prism"
+          STEPS_IMPORT_GPG_OUTPUTS_NAME: ${{steps.import_gpg.outputs.name}}
+          GITHUB_EVENT_INPUTS_APACHE_ID: ${{ github.event.inputs.APACHE_ID }}
+          GITHUB_EVENT_INPUTS_APACHE_PASSWORD: ${{ github.event.inputs.APACHE_PASSWORD }}
         run: |
           # TODO stop the action if a non-prerelease release exists
           # TODO create the draft release automatically if none exist.
@@ -524,7 +561,7 @@ jobs:
                 zip -r $ZIP_NAME $ARTIFACT
 
                 # Sign and hash
-                gpg --local-user "${{steps.import_gpg.outputs.name}}" --armor --batch --yes --detach-sig $ZIP_NAME
+                gpg --local-user "${STEPS_IMPORT_GPG_OUTPUTS_NAME}" --armor --batch --yes --detach-sig $ZIP_NAME
                 sha512sum $ZIP_NAME > "${ZIP_NAME}.sha512"
 
                 # Upload to the release.
@@ -550,7 +587,7 @@ jobs:
 
           svn add --force --parents prism
           svn status
-          svn commit -m "Staging Prism artifacts for Apache Beam ${RELEASE} RC${RC_NUM}" --non-interactive --username "${{ github.event.inputs.APACHE_ID }}" --password "${{ github.event.inputs.APACHE_PASSWORD }}"
+          svn commit -m "Staging Prism artifacts for Apache Beam ${RELEASE} RC${RC_NUM}" --non-interactive --username "${GITHUB_EVENT_INPUTS_APACHE_ID}" --password "${GITHUB_EVENT_INPUTS_APACHE_PASSWORD}"
 
   managed_io_docs_pr:
     if:  ${{ fromJson(github.event.inputs.STAGE).managed_io_docs_pr == 'yes'}}
@@ -598,8 +635,10 @@ jobs:
         working-directory: beam
         run: |
           mkdir -p ~/.apache_beam/cache/jars/
-          cp sdks/java/io/expansion-service/build/libs/beam-sdks-java-io-expansion-service-${{ github.event.inputs.RELEASE }}.jar ~/.apache_beam/cache/jars/
-          cp sdks/java/io/google-cloud-platform/expansion-service/build/libs/beam-sdks-java-io-google-cloud-platform-expansion-service-${{ github.event.inputs.RELEASE }}.jar ~/.apache_beam/cache/jars/
+          cp sdks/java/io/expansion-service/build/libs/beam-sdks-java-io-expansion-service-${GITHUB_EVENT_INPUTS_RELEASE}.jar ~/.apache_beam/cache/jars/
+          cp sdks/java/io/google-cloud-platform/expansion-service/build/libs/beam-sdks-java-io-google-cloud-platform-expansion-service-${GITHUB_EVENT_INPUTS_RELEASE}.jar ~/.apache_beam/cache/jars/
+        env:
+          GITHUB_EVENT_INPUTS_RELEASE: ${{ github.event.inputs.RELEASE }}
       - name: Generate Managed IO Docs
         working-directory: beam/sdks/python
         run: |
@@ -613,8 +652,11 @@ jobs:
           git config user.name $GITHUB_ACTOR
           git config user.email actions@"$RUNNER_NAME".local
           git add ${{ env.MANAGED_IO_DOCS_PATH }}
-          git commit --allow-empty -m "Update managed-io.md for release ${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}."
+          git commit --allow-empty -m "Update managed-io.md for release ${GITHUB_EVENT_INPUTS_RELEASE}-RC${GITHUB_EVENT_INPUTS_RC}."
           git push -f --set-upstream origin $BRANCH_NAME
+        env:
+          GITHUB_EVENT_INPUTS_RELEASE: ${{ github.event.inputs.RELEASE }}
+          GITHUB_EVENT_INPUTS_RC: ${{ github.event.inputs.RC }}
       - name: Create beam PR
         working-directory: beam
         env:
diff --git a/.github/workflows/build_runner_image.yml b/.github/workflows/build_runner_image.yml
index 4b556628e6c8..354ad38c5188 100644
--- a/.github/workflows/build_runner_image.yml
+++ b/.github/workflows/build_runner_image.yml
@@ -41,6 +41,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         ref: ${{ github.event.pull_request.head.sha }}
+        persist-credentials: false
     - name: GCloud Docker credential helper
       run: |
         gcloud auth configure-docker ${{env.docker_registry}}
diff --git a/.github/workflows/build_wheels.yml b/.github/workflows/build_wheels.yml
index e4fc279d0b34..3b8fc35eb858 100644
--- a/.github/workflows/build_wheels.yml
+++ b/.github/workflows/build_wheels.yml
@@ -56,6 +56,8 @@ jobs:
       py-versions-test: ${{ steps.set-py-versions.outputs.py-versions-test }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: "Check are GCP variables set"
         run: "./scripts/ci/ci_check_are_gcp_variables_set.sh"
         id: check_gcp_variables
@@ -89,6 +91,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install python
         uses: actions/setup-python@v5
         with:
@@ -100,9 +104,11 @@ jobs:
       - name: Check whether an -RC tag was applied to the commit.
         id: is_rc
         run: |
-          echo ${{ steps.get_tag.outputs.TAG }} > temp
+          echo ${STEPS_GET_TAG_OUTPUTS_TAG} > temp
           OUTPUT=$( if  grep -e '-RC.' -q temp; then echo 1; else echo 0; fi)
           echo "is_rc=$OUTPUT" >> $GITHUB_OUTPUT
+        env:
+          STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.TAG }}
       - name: Get RELEASE_VERSION and RC_NUM
         if: steps.is_rc.outputs.is_rc == 1
         id: get_rc_version
@@ -146,9 +152,12 @@ jobs:
         if: steps.is_rc.outputs.is_rc == 1
         working-directory: ./sdks/python
         run: |
-          RELEASE_VERSION=${{ steps.get_rc_version.outputs.RELEASE_VERSION }}
-          RC_NUM=${{ steps.get_rc_version.outputs.RC_NUM }}
+          RELEASE_VERSION=${STEPS_GET_RC_VERSION_OUTPUTS_RELEASE_VERSION}
+          RC_NUM=${STEPS_GET_RC_VERSION_OUTPUTS_RC_NUM}
           sed -i -e "s/${RELEASE_VERSION}/${RELEASE_VERSION}rc${RC_NUM}/g" apache_beam/version.py
+        env:
+          STEPS_GET_RC_VERSION_OUTPUTS_RELEASE_VERSION: ${{ steps.get_rc_version.outputs.RELEASE_VERSION }}
+          STEPS_GET_RC_VERSION_OUTPUTS_RC_NUM: ${{ steps.get_rc_version.outputs.RC_NUM }}
       - name: Build RC source
         if: steps.is_rc.outputs.is_rc == 1
         working-directory: ./sdks/python
@@ -191,7 +200,7 @@ jobs:
     if: needs.check_env_variables.outputs.gcp-variables-set == 'true' && github.event_name != 'pull_request'
     steps:
       - name: Remove existing files on GCS bucket
-        run: gsutil rm -r ${{ env.GCP_PATH }} || true
+        run: gsutil rm -r ${GCP_PATH} || true
 
   upload_source_to_gcs:
     name: Upload python source distribution to GCS bucket
@@ -207,7 +216,7 @@ jobs:
           name: source_zip
           path: source/
       - name: Copy sources to GCS bucket
-        run: gsutil cp -r -a public-read source/* ${{ env.GCP_PATH }}
+        run: gsutil cp -r -a public-read source/* ${GCP_PATH}
 
   build_wheels:
     name: Build python ${{matrix.py_version}} wheels on ${{matrix.os_python.arch}} for ${{ matrix.os_python.os }}
@@ -320,7 +329,7 @@ jobs:
         merge-multiple: true
         path: wheelhouse/
     - name: Copy wheels to GCS bucket
-      run: gsutil cp -r -a public-read wheelhouse/* ${{ env.GCP_PATH }}
+      run: gsutil cp -r -a public-read wheelhouse/* ${GCP_PATH}
     - name: Create github action information file on GCS bucket
       run: |
         cat > github_action_info <<EOF
@@ -338,9 +347,9 @@ jobs:
         GITHUB_BASE_REF=$GITHUB_BASE_REF
         EOF
         echo $(cat github_action_info)
-        gsutil cp -a public-read github_action_info ${{ env.GCP_PATH }}
+        gsutil cp -a public-read github_action_info ${GCP_PATH}
     - name: Upload GitHub event file to GCS bucket
-      run: gsutil cp -a public-read ${GITHUB_EVENT_PATH} ${{ env.GCP_PATH }}
+      run: gsutil cp -a public-read ${GITHUB_EVENT_PATH} ${GCP_PATH}
 
   list_files_on_gcs:
     name: List files on Google Cloud Storage Bucket
@@ -351,7 +360,7 @@ jobs:
     if: needs.check_env_variables.outputs.gcp-variables-set == 'true' && github.event_name != 'pull_request'
     steps:
     - name: List file on Google Cloud Storage Bucket
-      run: gsutil ls "${{ env.GCP_PATH }}*"
+      run: gsutil ls "${GCP_PATH}*"
 
   branch_repo_nightly:
     permissions:
diff --git a/.github/workflows/code_completion_plugin_tests.yml b/.github/workflows/code_completion_plugin_tests.yml
index a9930567d648..8e74ec1c684a 100644
--- a/.github/workflows/code_completion_plugin_tests.yml
+++ b/.github/workflows/code_completion_plugin_tests.yml
@@ -60,6 +60,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           path: main
+          persist-credentials: false
 
       # Check out intellij community repository for tests
       - name: Fetch intellij-community Sources
@@ -67,6 +68,7 @@ jobs:
         with:
           repository: JetBrains/intellij-community
           path: intellij
+          persist-credentials: false
 
       # Setup Java environment for the next steps
       - name: Setup Java
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0a7aa09530a8..2b4e03b88813 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -75,6 +75,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v7
+      with:
+        persist-credentials: false
 
     - name: Set up Go
       if: matrix.language == 'go'
diff --git a/.github/workflows/cut_release_branch.yml b/.github/workflows/cut_release_branch.yml
index 8b591524ba55..012a5b6bbb2d 100644
--- a/.github/workflows/cut_release_branch.yml
+++ b/.github/workflows/cut_release_branch.yml
@@ -62,6 +62,8 @@ jobs:
           fi
       - name: Check out code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set git config
         run: |
           git config user.name $GITHUB_ACTOR
@@ -111,6 +113,8 @@ jobs:
           fi
       - name: Check out code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set git config
         run: |
           git config user.name $GITHUB_ACTOR
diff --git a/.github/workflows/dask_runner_tests.yml b/.github/workflows/dask_runner_tests.yml
index 2b279bd3ac2f..6282d5b50395 100644
--- a/.github/workflows/dask_runner_tests.yml
+++ b/.github/workflows/dask_runner_tests.yml
@@ -41,6 +41,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install python
         uses: actions/setup-python@v5
         with:
@@ -70,6 +72,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install python
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/deploy_release_candidate_pypi.yaml b/.github/workflows/deploy_release_candidate_pypi.yaml
index b8eb07c44172..7cd98ee6d61e 100644
--- a/.github/workflows/deploy_release_candidate_pypi.yaml
+++ b/.github/workflows/deploy_release_candidate_pypi.yaml
@@ -31,6 +31,8 @@ jobs:
         echo "::add-mask::$PYPI_API_TOKEN"
     - name: Checkout
       uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup environment
       uses: ./.github/actions/setup-environment-action
       with:
@@ -50,6 +52,8 @@ jobs:
         SCRIPT_DIR: release/src/main/scripts
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         SVN_ARTIFACTS_DIR: "beam/${{ github.event.inputs.RELEASE }}/python"
+        GITHUB_EVENT_INPUTS_RC: ${{ github.event.inputs.RC }}
+        GITHUB_EVENT_INPUTS_PYPI_API_TOKEN: ${{ github.event.inputs.PYPI_API_TOKEN }}
       run: |
         git fetch --all --tags --prune
         RELEASE_COMMIT=$(git rev-list -n 1 $RC_TAG)
@@ -61,14 +65,14 @@ jobs:
           --rc-tag "${RC_TAG}" \
           --release-commit "${RELEASE_COMMIT}" \
           --artifacts_dir "${PYTHON_ARTIFACTS_DIR}" \
-          --rc_number "${{ github.event.inputs.RC }}" \
+          --rc_number "${GITHUB_EVENT_INPUTS_RC}" \
           --yes True
 
         cd "${PYTHON_ARTIFACTS_DIR}"
         ls
 
-        echo "------Checking Hash Value for apache_beam-${RELEASE}rc${{ github.event.inputs.RC }}.tar.gz-----"
-        sha512sum -c "apache_beam-${RELEASE}rc${{ github.event.inputs.RC }}.tar.gz.sha512"
+        echo "------Checking Hash Value for apache_beam-${RELEASE}rc${GITHUB_EVENT_INPUTS_RC}.tar.gz-----"
+        sha512sum -c "apache_beam-${RELEASE}rc${GITHUB_EVENT_INPUTS_RC}.tar.gz.sha512"
         
         for artifact in *.whl; do
           echo "----------Checking Hash Value for ${artifact} wheel-----------"
@@ -83,4 +87,4 @@ jobs:
         echo "Will upload the following files to PyPI:"
         ls
 
-        twine upload --verbose * -u __token__ -p "${{ github.event.inputs.PYPI_API_TOKEN }}"
+        twine upload --verbose * -u __token__ -p "${GITHUB_EVENT_INPUTS_PYPI_API_TOKEN}"
diff --git a/.github/workflows/finalize_release.yml b/.github/workflows/finalize_release.yml
index 16c3c2df2c0f..9295a89192c9 100644
--- a/.github/workflows/finalize_release.yml
+++ b/.github/workflows/finalize_release.yml
@@ -99,6 +99,8 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Mask PyPi password
       run: |
         # Workaround for Actions bug - https://github.com/actions/runner/issues/643
@@ -129,12 +131,13 @@ jobs:
     - name: Deploy to Pypi
       env:
         RELEASE: "${{ github.event.inputs.RELEASE }}"
+        GITHUB_EVENT_INPUTS_PYPI_API_TOKEN: ${{ github.event.inputs.PYPI_API_TOKEN }}
       run: |
         wget -e robots=off -r --no-parent -A tar.gz,whl "https://dist.apache.org/repos/dist/dev/beam/${RELEASE}/python"
         cd "dist.apache.org/repos/dist/dev/beam/${RELEASE}/python/"
         echo "Will upload the following files to PyPI:"
         ls
-        twine upload * -u __token__ -p "${{ github.event.inputs.PYPI_API_TOKEN }}"
+        twine upload * -u __token__ -p "${GITHUB_EVENT_INPUTS_PYPI_API_TOKEN}"
 
   push_git_tags:
     if: ${{github.event.inputs.TAG_RELEASE == 'yes'}}
@@ -160,6 +163,7 @@ jobs:
         VERSION_TAG: "v${{ github.event.inputs.RELEASE }}"
         RC_TAG: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
         POST_RELEASE_BRANCH: "release-${{ github.event.inputs.RELEASE }}-postrelease"
+        STEPS_IMPORT_GPG_OUTPUTS_NAME: ${{steps.import_gpg.outputs.name}}
       run: |
         # Ensure local tags are in sync. If there's a mismatch, it will tell you.
         git fetch --all --tags --prune
@@ -168,11 +172,11 @@ jobs:
         git rev-list $RC_TAG -n 1
 
         # Tag for Go SDK
-        git tag "sdks/$VERSION_TAG" "$RC_TAG"^{} -m "Tagging release" --local-user="${{steps.import_gpg.outputs.name}}"
+        git tag "sdks/$VERSION_TAG" "$RC_TAG"^{} -m "Tagging release" --local-user="${STEPS_IMPORT_GPG_OUTPUTS_NAME}"
         git push origin "sdks/$VERSION_TAG"
 
         # Tag for repo root.
-        git tag "$VERSION_TAG" "$RC_TAG"^{} -m "Tagging release" --local-user="${{steps.import_gpg.outputs.name}}"
+        git tag "$VERSION_TAG" "$RC_TAG"^{} -m "Tagging release" --local-user="${STEPS_IMPORT_GPG_OUTPUTS_NAME}"
         git push origin "$VERSION_TAG"
 
         git checkout -b "$POST_RELEASE_BRANCH" "$VERSION_TAG"
@@ -189,6 +193,7 @@ jobs:
         with:
           token: ${{ github.event.inputs.REPO_TOKEN }}
           ref: master
+          persist-credentials: false
       - name: Set git config
         run: |
           git config user.name $GITHUB_ACTOR
diff --git a/.github/workflows/flaky_test_detection.yml b/.github/workflows/flaky_test_detection.yml
index 30d51147c666..b7d6ce1c6f59 100644
--- a/.github/workflows/flaky_test_detection.yml
+++ b/.github/workflows/flaky_test_detection.yml
@@ -39,6 +39,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with: 
           python-version: 3.11
diff --git a/.github/workflows/git_tag_released_version.yml b/.github/workflows/git_tag_released_version.yml
index ecb63232be5c..3b6567c7e4b2 100644
--- a/.github/workflows/git_tag_released_version.yml
+++ b/.github/workflows/git_tag_released_version.yml
@@ -38,17 +38,25 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set git config
         run: |
           git config user.name $GITHUB_ACTOR
           git config user.email actions@"$RUNNER_NAME".local
       - name: Tag for Go SDK
         run: |
-          git tag -a sdks/${{ github.event.inputs.VERSION_TAG }} -m ${{ github.event.inputs.RC_TAG }}
-          git push https://github.com/apache/beam sdks/${{ github.event.inputs.VERSION_TAG }}
+          git tag -a sdks/${GITHUB_EVENT_INPUTS_VERSION_TAG} -m ${GITHUB_EVENT_INPUTS_RC_TAG}
+          git push https://github.com/apache/beam sdks/${GITHUB_EVENT_INPUTS_VERSION_TAG}
+        env:
+          GITHUB_EVENT_INPUTS_VERSION_TAG: ${{ github.event.inputs.VERSION_TAG }}
+          GITHUB_EVENT_INPUTS_RC_TAG: ${{ github.event.inputs.RC_TAG }}
       - name: Tag for repo root
         run: |
-          git tag -a ${{ github.event.inputs.VERSION_TAG }} -m ${{ github.event.inputs.RC_TAG }}
-          git push https://github.com/apache/beam ${{ github.event.inputs.VERSION_TAG }}
+          git tag -a ${GITHUB_EVENT_INPUTS_VERSION_TAG} -m ${GITHUB_EVENT_INPUTS_RC_TAG}
+          git push https://github.com/apache/beam ${GITHUB_EVENT_INPUTS_VERSION_TAG}
+        env:
+          GITHUB_EVENT_INPUTS_VERSION_TAG: ${{ github.event.inputs.VERSION_TAG }}
+          GITHUB_EVENT_INPUTS_RC_TAG: ${{ github.event.inputs.RC_TAG }}
 
 
diff --git a/.github/workflows/go_tests.yml b/.github/workflows/go_tests.yml
index 644d9a52cb12..5355f80810fe 100644
--- a/.github/workflows/go_tests.yml
+++ b/.github/workflows/go_tests.yml
@@ -43,6 +43,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 2
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
diff --git a/.github/workflows/issue-tagger.yml b/.github/workflows/issue-tagger.yml
index a893a168934f..a494c3c9b814 100644
--- a/.github/workflows/issue-tagger.yml
+++ b/.github/workflows/issue-tagger.yml
@@ -25,6 +25,8 @@ jobs:
       issues: write
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - uses: damccorm/tag-ur-it@6fa72bbf1a2ea157b533d7e7abeafdb5855dbea5
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/local_env_tests.yml b/.github/workflows/local_env_tests.yml
index 96682a46f4dd..1ab4f8e1c77e 100644
--- a/.github/workflows/local_env_tests.yml
+++ b/.github/workflows/local_env_tests.yml
@@ -46,6 +46,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
@@ -63,6 +65,8 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
diff --git a/.github/workflows/playground_frontend_test.yml b/.github/workflows/playground_frontend_test.yml
index b54fdc0ecfd6..f204a84da260 100644
--- a/.github/workflows/playground_frontend_test.yml
+++ b/.github/workflows/playground_frontend_test.yml
@@ -46,6 +46,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: 'Cache Flutter Dependencies'
         uses: actions/cache@v6
diff --git a/.github/workflows/pr-bot-new-prs.yml b/.github/workflows/pr-bot-new-prs.yml
index 04219453b1ea..801edd8b39d6 100644
--- a/.github/workflows/pr-bot-new-prs.yml
+++ b/.github/workflows/pr-bot-new-prs.yml
@@ -34,6 +34,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/pr-bot-pr-updates.yml b/.github/workflows/pr-bot-pr-updates.yml
index 8f31a70f29c0..a761d604e203 100644
--- a/.github/workflows/pr-bot-pr-updates.yml
+++ b/.github/workflows/pr-bot-pr-updates.yml
@@ -39,6 +39,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           ref: 'master'
+          persist-credentials: false
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/pr-bot-prs-needing-attention.yml b/.github/workflows/pr-bot-prs-needing-attention.yml
index 977e730a7721..0049fa81fe1a 100644
--- a/.github/workflows/pr-bot-prs-needing-attention.yml
+++ b/.github/workflows/pr-bot-prs-needing-attention.yml
@@ -34,6 +34,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
@@ -45,4 +47,4 @@ jobs:
       - run: npm run findPrsNeedingAttention
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        working-directory: 'scripts/ci/pr-bot'
\ No newline at end of file
+        working-directory: 'scripts/ci/pr-bot'
diff --git a/.github/workflows/publish_github_release_notes.yml b/.github/workflows/publish_github_release_notes.yml
index 27257e095957..a40b4432443e 100644
--- a/.github/workflows/publish_github_release_notes.yml
+++ b/.github/workflows/publish_github_release_notes.yml
@@ -36,7 +36,9 @@ jobs:
       properties: ${{ steps.test-properties.outputs.properties }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7        
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false        
       - id: test-properties
         uses: ./.github/actions/setup-default-test-properties
 
@@ -50,9 +52,11 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Publish github release notes
         run: |
-          POST_PATH="website/www/site/content/en/blog/beam-${{env.RELEASE_VERSION}}.md"
+          POST_PATH="website/www/site/content/en/blog/beam-${RELEASE_VERSION}.md"
           RELEASE_NOTES=$(
           cat ${POST_PATH} |                               # Read post's content
           sed -n '/<!--/,$p' |                             # Remove post's metadata
@@ -73,7 +77,7 @@ jobs:
           echo -e "Below is the request JSON about to be sent to the Github API:\n\n ${REQUEST_JSON}\n\n"
           curl https://api.github.com/repos/apache/beam/releases \
           -X POST \
-          -H "Authorization: token ${{env.GITHUB_TOKEN}}" \
+          -H "Authorization: token ${GITHUB_TOKEN}" \
           -H "Content-Type:application/json" \
           -d "${REQUEST_JSON}"
-          echo -e "\n\nView the release on Github: https://github.com/apache/beam/releases/tag/v${RELEASE_VERSION}"
\ No newline at end of file
+          echo -e "\n\nView the release on Github: https://github.com/apache/beam/releases/tag/v${RELEASE_VERSION}"
diff --git a/.github/workflows/python_dependency_tests.yml b/.github/workflows/python_dependency_tests.yml
index 8a9010bf7817..77640a7d1c17 100644
--- a/.github/workflows/python_dependency_tests.yml
+++ b/.github/workflows/python_dependency_tests.yml
@@ -35,6 +35,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install libsnappy-dev
         run: sudo apt-get update && sudo apt-get install -y libsnappy-dev
       - name: Install python
diff --git a/.github/workflows/python_tests.yml b/.github/workflows/python_tests.yml
index b650f2ea5cda..68dd33d815bd 100644
--- a/.github/workflows/python_tests.yml
+++ b/.github/workflows/python_tests.yml
@@ -46,6 +46,8 @@ jobs:
       gcp-variables-set: ${{ steps.check_gcp_variables.outputs.gcp-variables-set }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: "Check are GCP variables set"
         run: "./scripts/ci/ci_check_are_gcp_variables_set.sh"
         id: check_gcp_variables
@@ -69,6 +71,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
@@ -102,6 +106,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:
@@ -138,6 +144,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install python
         uses: ./.github/actions/setup-environment-action
         with:
diff --git a/.github/workflows/refresh_looker_metrics.yml b/.github/workflows/refresh_looker_metrics.yml
index 187752549741..bf864d4bbcd2 100644
--- a/.github/workflows/refresh_looker_metrics.yml
+++ b/.github/workflows/refresh_looker_metrics.yml
@@ -32,6 +32,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: 3.11
diff --git a/.github/workflows/reportGenerator.yml b/.github/workflows/reportGenerator.yml
index fbd33d8ee6c2..8f34476271ac 100644
--- a/.github/workflows/reportGenerator.yml
+++ b/.github/workflows/reportGenerator.yml
@@ -27,6 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Setup Node
       uses: actions/setup-node@v6
       with:
diff --git a/.github/workflows/republish_released_docker_containers.yml b/.github/workflows/republish_released_docker_containers.yml
index 6c72422d3d5a..fc1bb29f45c9 100644
--- a/.github/workflows/republish_released_docker_containers.yml
+++ b/.github/workflows/republish_released_docker_containers.yml
@@ -61,6 +61,7 @@ jobs:
         with:
           ref: "release-${{ env.release }}-postrelease"
           repository: apache/beam
+          persist-credentials: false
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.1
       - name: Install Java 11
@@ -97,7 +98,7 @@ jobs:
           -Pdocker-pull-licenses \
           -Pprune-images ${{ matrix.images_to_publish.include_skip_flags }} \
           -Pdocker-repository-root=gcr.io/apache-beam-testing/updated_released_container_images \
-          -Pdocker-tag-list=${{ env.release }},${{ github.sha }},$(date +'%Y-%m-%d') \
+          -Pdocker-tag-list=${release},${{ github.sha }},$(date +'%Y-%m-%d') \
           --no-daemon \
           --no-parallel
 
diff --git a/.github/workflows/run_perf_alert_tool.yml b/.github/workflows/run_perf_alert_tool.yml
index 301fe0d12ce5..db2ce8f5921b 100644
--- a/.github/workflows/run_perf_alert_tool.yml
+++ b/.github/workflows/run_perf_alert_tool.yml
@@ -36,6 +36,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install python
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/run_rc_validation_go_wordcount.yml b/.github/workflows/run_rc_validation_go_wordcount.yml
index 2112bec6b3f8..7525634e3dbb 100644
--- a/.github/workflows/run_rc_validation_go_wordcount.yml
+++ b/.github/workflows/run_rc_validation_go_wordcount.yml
@@ -49,6 +49,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up environment
         uses: ./.github/actions/setup-environment-action
diff --git a/.github/workflows/run_rc_validation_java_mobile_gaming.yml b/.github/workflows/run_rc_validation_java_mobile_gaming.yml
index 0a2d08b80517..0dfda77e0f15 100644
--- a/.github/workflows/run_rc_validation_java_mobile_gaming.yml
+++ b/.github/workflows/run_rc_validation_java_mobile_gaming.yml
@@ -75,12 +75,15 @@ jobs:
     timeout-minutes: 120 # Adjust timeout as needed
     steps:
       - name: Extract GCS Bucket Name
-        run: echo "GCS_BUCKET_NAME=$(echo ${{ github.event.inputs.GCS_BUCKET }} | sed 's/^gs:\/\///')" >> $GITHUB_ENV
+        run: echo "GCS_BUCKET_NAME=$(echo ${GITHUB_EVENT_INPUTS_GCS_BUCKET} | sed 's/^gs:\/\///')" >> $GITHUB_ENV
+        env:
+          GITHUB_EVENT_INPUTS_GCS_BUCKET: ${{ github.event.inputs.GCS_BUCKET }}
       
       - name: Checkout code at RC tag
         uses: actions/checkout@v7
         with:
           ref: v${{ github.event.inputs.RELEASE_VER }}-RC${{ github.event.inputs.RC_NUM }}
+          persist-credentials: false
 
       # Standard setup actions (consider if setup-action is needed or if manual setup is sufficient)
       - name: Setup environment
@@ -91,13 +94,13 @@ jobs:
       # Setup GCP resources
       - name: Create BigQuery Dataset
         run: |
-          echo "Creating BigQuery dataset: ${{ env.BQ_DATASET }} in project ${{ env.GCP_PROJECT_ID }}"
-          bq mk --project_id=${{ env.GCP_PROJECT_ID }} ${{ env.BQ_DATASET }}
+          echo "Creating BigQuery dataset: ${BQ_DATASET} in project ${{ env.GCP_PROJECT_ID }}"
+          bq mk --project_id=${{ env.GCP_PROJECT_ID }} ${BQ_DATASET}
         shell: bash
       - name: Create PubSub Topic
         run: |
-          echo "Creating PubSub topic: ${{ env.PUBSUB_TOPIC }} in project ${{ env.GCP_PROJECT_ID }}"
-          gcloud pubsub topics create --project=${{ env.GCP_PROJECT_ID }} ${{ env.PUBSUB_TOPIC }}
+          echo "Creating PubSub topic: ${PUBSUB_TOPIC} in project ${{ env.GCP_PROJECT_ID }}"
+          gcloud pubsub topics create --project=${{ env.GCP_PROJECT_ID }} ${PUBSUB_TOPIC}
         shell: bash
   
       # Run the Mobile Gaming example test using Gradle
@@ -117,14 +120,14 @@ jobs:
       - name: Cleanup BigQuery Dataset
         if: always()
         run: |
-          echo "Deleting BigQuery dataset: ${{ env.BQ_DATASET }} in project ${{ env.GCP_PROJECT_ID }}"
-          bq rm --project_id=${{ env.GCP_PROJECT_ID }} -f -r ${{ env.BQ_DATASET }} || echo "Failed to delete BQ dataset ${{ env.BQ_DATASET }}, continuing..."
+          echo "Deleting BigQuery dataset: ${BQ_DATASET} in project ${{ env.GCP_PROJECT_ID }}"
+          bq rm --project_id=${{ env.GCP_PROJECT_ID }} -f -r ${BQ_DATASET} || echo "Failed to delete BQ dataset ${BQ_DATASET}, continuing..."
         shell: bash
       - name: Cleanup PubSub Topic
         if: always()
         run: |
-          echo "Deleting PubSub topic: ${{ env.PUBSUB_TOPIC }} in project ${{ env.GCP_PROJECT_ID }}"
-          gcloud pubsub topics delete --project=${{ env.GCP_PROJECT_ID }} ${{ env.PUBSUB_TOPIC }} --quiet || echo "Failed to delete PubSub topic ${{ env.PUBSUB_TOPIC }}, continuing..."
+          echo "Deleting PubSub topic: ${PUBSUB_TOPIC} in project ${{ env.GCP_PROJECT_ID }}"
+          gcloud pubsub topics delete --project=${{ env.GCP_PROJECT_ID }} ${PUBSUB_TOPIC} --quiet || echo "Failed to delete PubSub topic ${PUBSUB_TOPIC}, continuing..."
         shell: bash
 
       # Reporting (Optional: Keep if test results are generated)
diff --git a/.github/workflows/run_rc_validation_java_quickstart.yml b/.github/workflows/run_rc_validation_java_quickstart.yml
index 10e743b9cfee..f671ed5e7825 100644
--- a/.github/workflows/run_rc_validation_java_quickstart.yml
+++ b/.github/workflows/run_rc_validation_java_quickstart.yml
@@ -71,6 +71,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ env.RC_TAG }}
+          persist-credentials: false
 
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
diff --git a/.github/workflows/run_rc_validation_python_mobile_gaming.yml b/.github/workflows/run_rc_validation_python_mobile_gaming.yml
index 8776fa2b70bf..9a5bbfcf573f 100644
--- a/.github/workflows/run_rc_validation_python_mobile_gaming.yml
+++ b/.github/workflows/run_rc_validation_python_mobile_gaming.yml
@@ -92,6 +92,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ env.RC_TAG }}
+          persist-credentials: false
 
       - name: Download validate_table.sh from master branch
         run: |
@@ -119,18 +120,18 @@ jobs:
 
       - name: Download RC Artifacts
         run: |
-          echo "Downloading from ${{ env.APACHE_DIST_URL_BASE }}"
-          wget ${{ env.APACHE_DIST_URL_BASE }}/python/${{ env.BEAM_PYTHON_SDK_TAR_GZ }}
-          wget ${{ env.APACHE_DIST_URL_BASE }}/python/${{ env.BEAM_PYTHON_SDK_TAR_GZ }}.sha512
-          wget ${{ env.APACHE_DIST_URL_BASE }}/${{ env.BEAM_SOURCE_ZIP }}
-          wget ${{ env.APACHE_DIST_URL_BASE }}/${{ env.BEAM_SOURCE_ZIP }}.sha512
+          echo "Downloading from ${APACHE_DIST_URL_BASE}"
+          wget ${APACHE_DIST_URL_BASE}/python/${BEAM_PYTHON_SDK_TAR_GZ}
+          wget ${APACHE_DIST_URL_BASE}/python/${BEAM_PYTHON_SDK_TAR_GZ}.sha512
+          wget ${APACHE_DIST_URL_BASE}/${BEAM_SOURCE_ZIP}
+          wget ${APACHE_DIST_URL_BASE}/${BEAM_SOURCE_ZIP}.sha512
         shell: bash
 
       - name: Verify Hashes
         run: |
           echo "Verifying sha512 checksums..."
-          sha512sum -c ${{ env.BEAM_PYTHON_SDK_TAR_GZ }}.sha512
-          sha512sum -c ${{ env.BEAM_SOURCE_ZIP }}.sha512
+          sha512sum -c ${BEAM_PYTHON_SDK_TAR_GZ}.sha512
+          sha512sum -c ${BEAM_SOURCE_ZIP}.sha512
         shell: bash
 
       - name: Setup Python Virtual Environment
@@ -146,19 +147,19 @@ jobs:
         run: |
           echo "Building Python SDK sdist..."
           source beam_env/bin/activate
-          unzip ${{ env.BEAM_SOURCE_ZIP }}
-          mkdir -p beam-${{ env.RELEASE_VERSION }}/website/www/site/content/en/documentation/sdks
+          unzip ${BEAM_SOURCE_ZIP}
+          mkdir -p beam-${RELEASE_VERSION}/website/www/site/content/en/documentation/sdks
           sudo mkdir -p /website/www/site/content/en/documentation/sdks
-          cd beam-${{ env.RELEASE_VERSION }}/sdks/python
+          cd beam-${RELEASE_VERSION}/sdks/python
           python -m build --sdist
         shell: bash
 
       - name: Install Python SDK
         run: |
-          echo "Installing built Python SDK: apache_beam-${{ env.RELEASE_VERSION }}.tar.gz"
+          echo "Installing built Python SDK: apache_beam-${RELEASE_VERSION}.tar.gz"
           source beam_env/bin/activate
-          pip install beam-${{ env.RELEASE_VERSION }}/sdks/python/dist/apache_beam-${{ env.RELEASE_VERSION }}.tar.gz
-          pip install beam-${{ env.RELEASE_VERSION }}/sdks/python/dist/apache_beam-${{ env.RELEASE_VERSION }}.tar.gz[gcp]
+          pip install beam-${RELEASE_VERSION}/sdks/python/dist/apache_beam-${RELEASE_VERSION}.tar.gz
+          pip install beam-${RELEASE_VERSION}/sdks/python/dist/apache_beam-${RELEASE_VERSION}.tar.gz[gcp]
           echo "SDK installed."
           pip freeze # Log installed packages
         shell: bash
@@ -166,8 +167,8 @@ jobs:
       # ================== GCP Resource Setup ==================
       - name: Create BigQuery Dataset
         run: |
-          echo "Creating BigQuery dataset: ${{ env.BQ_DATASET }} in project ${{ env.GCP_PROJECT_ID }}"
-          bq mk --project_id=${{ env.GCP_PROJECT_ID }} ${{ env.BQ_DATASET }}
+          echo "Creating BigQuery dataset: ${BQ_DATASET} in project ${{ env.GCP_PROJECT_ID }}"
+          bq mk --project_id=${{ env.GCP_PROJECT_ID }} ${BQ_DATASET}
         shell: bash
 
       - name: Create GCS Bucket (if needed - reusing input bucket)
@@ -178,8 +179,8 @@ jobs:
 
       - name: Create PubSub Topic
         run: |
-          echo "Creating PubSub topic: ${{ env.PUBSUB_TOPIC }} in project ${{ env.GCP_PROJECT_ID }}"
-          gcloud pubsub topics create --project=${{ env.GCP_PROJECT_ID }} ${{ env.PUBSUB_TOPIC }}
+          echo "Creating PubSub topic: ${PUBSUB_TOPIC} in project ${{ env.GCP_PROJECT_ID }}"
+          gcloud pubsub topics create --project=${{ env.GCP_PROJECT_ID }} ${PUBSUB_TOPIC}
         shell: bash
 
       # ================== Java Data Injector ==================
@@ -196,9 +197,9 @@ jobs:
                 </activation>
                 <repositories>
                   <repository>
-                    <id>Release ${{ env.RELEASE_VERSION }} RC${{ env.RC_NUM }}</id>
-                    <name>Release ${{ env.RELEASE_VERSION }} RC${{ env.RC_NUM }}</name>
-                    <url>${{ env.APACHE_REPO_URL }}</url>
+                    <id>Release ${RELEASE_VERSION} RC${RC_NUM}</id>
+                    <name>Release ${RELEASE_VERSION} RC${RC_NUM}</name>
+                    <url>${APACHE_REPO_URL}</url>
                   </repository>
                 </repositories>
               </profile>
@@ -215,7 +216,7 @@ jobs:
           mvn archetype:generate \
               -DarchetypeGroupId=org.apache.beam \
               -DarchetypeArtifactId=beam-sdks-java-maven-archetypes-examples \
-              -DarchetypeVersion=${{ env.RELEASE_VERSION }} \
+              -DarchetypeVersion=${RELEASE_VERSION} \
               -DgroupId=org.example \
               -DartifactId=injector-temp \
               -Dversion="0.1" \
@@ -228,7 +229,7 @@ jobs:
           cd injector-temp
           # Compile and run, redirecting output to avoid polluting workflow logs
           mvn compile exec:java -Dexec.mainClass=org.apache.beam.examples.complete.game.injector.Injector \
-            -Dexec.args="${{ env.GCP_PROJECT_ID }} ${{ env.PUBSUB_TOPIC }} none" \
+            -Dexec.args="${{ env.GCP_PROJECT_ID }} ${PUBSUB_TOPIC} none" \
             -Dmaven.wagon.http.retryHandler.count=3 \
             -Dmaven.wagon.httpconnectionManager.ttlSeconds=25 > ../injector_run.log 2>&1 &
 
@@ -258,8 +259,8 @@ jobs:
           source beam_env/bin/activate
           python -m apache_beam.examples.complete.game.leader_board \
             --project=${{ env.GCP_PROJECT_ID }} \
-            --topic projects/${{ env.GCP_PROJECT_ID }}/topics/${{ env.PUBSUB_TOPIC }} \
-            --dataset ${{ env.BQ_DATASET }} &
+            --topic projects/${{ env.GCP_PROJECT_ID }}/topics/${PUBSUB_TOPIC} \
+            --dataset ${BQ_DATASET} &
 
           LB_DIRECT_PID=$!
           echo "Leaderboard (Direct Runner) started in background with PID: ${LB_DIRECT_PID}"
@@ -297,11 +298,11 @@ jobs:
           python -m apache_beam.examples.complete.game.leader_board \
             --project=${{ env.GCP_PROJECT_ID }} \
             --region=${{ env.GCE_REGION }} \
-            --topic projects/${{ env.GCP_PROJECT_ID }}/topics/${{ env.PUBSUB_TOPIC }} \
-            --dataset ${{ env.BQ_DATASET }} \
+            --topic projects/${{ env.GCP_PROJECT_ID }}/topics/${PUBSUB_TOPIC} \
+            --dataset ${BQ_DATASET} \
             --runner DataflowRunner \
             --temp_location=${{ env.GCS_BUCKET }}/temp/leaderboard/ \
-            --sdk_location=apache_beam-${{ env.RELEASE_VERSION }}.tar.gz \
+            --sdk_location=apache_beam-${RELEASE_VERSION}.tar.gz \
             > leaderboard_dataflow_submit.log 2>&1 &
 
           LB_DF_PID=$!
@@ -379,8 +380,8 @@ jobs:
           source beam_env/bin/activate
           python -m apache_beam.examples.complete.game.game_stats \
             --project=${{ env.GCP_PROJECT_ID }} \
-            --topic projects/${{ env.GCP_PROJECT_ID }}/topics/${{ env.PUBSUB_TOPIC }} \
-            --dataset ${{ env.BQ_DATASET }} \
+            --topic projects/${{ env.GCP_PROJECT_ID }}/topics/${PUBSUB_TOPIC} \
+            --dataset ${BQ_DATASET} \
             --fixed_window_duration ${{ env.GAME_STATS_WINDOW_DURATION }} &
 
           GS_DIRECT_PID=$!
@@ -420,11 +421,11 @@ jobs:
           python -m apache_beam.examples.complete.game.game_stats \
             --project=${{ env.GCP_PROJECT_ID }} \
             --region=${{ env.GCE_REGION }} \
-            --topic projects/${{ env.GCP_PROJECT_ID }}/topics/${{ env.PUBSUB_TOPIC }} \
-            --dataset ${{ env.BQ_DATASET }} \
+            --topic projects/${{ env.GCP_PROJECT_ID }}/topics/${PUBSUB_TOPIC} \
+            --dataset ${BQ_DATASET} \
             --runner DataflowRunner \
             --temp_location=${{ env.GCS_BUCKET }}/temp/gamestats/ \
-            --sdk_location=apache_beam-${{ env.RELEASE_VERSION }}.tar.gz \
+            --sdk_location=apache_beam-${RELEASE_VERSION}.tar.gz \
             --fixed_window_duration ${{ env.GAME_STATS_WINDOW_DURATION }} \
             > gamestats_dataflow_submit.log 2>&1 &
 
@@ -524,8 +525,8 @@ jobs:
       - name: Cleanup BigQuery Dataset
         if: always() && github.event.inputs.CLEANUP_BQ_RESOURCES == 'true'
         run: |
-          echo "Deleting BigQuery dataset: ${{ env.BQ_DATASET }} in project ${{ env.GCP_PROJECT_ID }}"
-          bq rm --project_id=${{ env.GCP_PROJECT_ID }} -f -r ${{ env.BQ_DATASET }} || echo "Failed to delete BQ dataset ${{ env.BQ_DATASET }}, continuing..."
+          echo "Deleting BigQuery dataset: ${BQ_DATASET} in project ${{ env.GCP_PROJECT_ID }}"
+          bq rm --project_id=${{ env.GCP_PROJECT_ID }} -f -r ${BQ_DATASET} || echo "Failed to delete BQ dataset ${BQ_DATASET}, continuing..."
         shell: bash
 
       - name: Cleanup GCS Bucket Objects and Logs
@@ -543,6 +544,6 @@ jobs:
       - name: Cleanup PubSub Topic
         if: always()
         run: |
-          echo "Deleting PubSub topic: ${{ env.PUBSUB_TOPIC }} in project ${{ env.GCP_PROJECT_ID }}"
-          gcloud pubsub topics delete --project=${{ env.GCP_PROJECT_ID }} ${{ env.PUBSUB_TOPIC }} --quiet || echo "Failed to delete PubSub topic ${{ env.PUBSUB_TOPIC }}, continuing..."
+          echo "Deleting PubSub topic: ${PUBSUB_TOPIC} in project ${{ env.GCP_PROJECT_ID }}"
+          gcloud pubsub topics delete --project=${{ env.GCP_PROJECT_ID }} ${PUBSUB_TOPIC} --quiet || echo "Failed to delete PubSub topic ${PUBSUB_TOPIC}, continuing..."
         shell: bash
diff --git a/.github/workflows/run_rc_validation_python_yaml.yml b/.github/workflows/run_rc_validation_python_yaml.yml
index 64da2d6b0465..d96d537658be 100644
--- a/.github/workflows/run_rc_validation_python_yaml.yml
+++ b/.github/workflows/run_rc_validation_python_yaml.yml
@@ -84,6 +84,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ env.RC_TAG }}
+          persist-credentials: false
 
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
@@ -106,19 +107,19 @@ jobs:
 
       - name: Download RC Artifacts
         run: |
-          echo "Downloading from ${{ env.APACHE_DIST_URL_BASE }}"
-          wget ${{ env.APACHE_DIST_URL_BASE }}/python/${{ env.BEAM_PYTHON_SDK_TAR_GZ }}
-          wget ${{ env.APACHE_DIST_URL_BASE }}/python/${{ env.BEAM_PYTHON_SDK_TAR_GZ }}.sha512
+          echo "Downloading from ${APACHE_DIST_URL_BASE}"
+          wget ${APACHE_DIST_URL_BASE}/python/${BEAM_PYTHON_SDK_TAR_GZ}
+          wget ${APACHE_DIST_URL_BASE}/python/${BEAM_PYTHON_SDK_TAR_GZ}.sha512
           # Source zip not strictly needed if installing from tar.gz, but keeping for consistency/potential future use
-          wget ${{ env.APACHE_DIST_URL_BASE }}/${{ env.BEAM_SOURCE_ZIP }}
-          wget ${{ env.APACHE_DIST_URL_BASE }}/${{ env.BEAM_SOURCE_ZIP }}.sha512
+          wget ${APACHE_DIST_URL_BASE}/${BEAM_SOURCE_ZIP}
+          wget ${APACHE_DIST_URL_BASE}/${BEAM_SOURCE_ZIP}.sha512
         shell: bash
 
       - name: Verify Hashes
         run: |
           echo "Verifying sha512 checksums..."
-          sha512sum -c ${{ env.BEAM_PYTHON_SDK_TAR_GZ }}.sha512
-          sha512sum -c ${{ env.BEAM_SOURCE_ZIP }}.sha512
+          sha512sum -c ${BEAM_PYTHON_SDK_TAR_GZ}.sha512
+          sha512sum -c ${BEAM_SOURCE_ZIP}.sha512
         shell: bash
 
       - name: Setup Python Virtual Environment
@@ -132,10 +133,10 @@ jobs:
 
       - name: Install Python SDK with [gcp, yaml] extras
         run: |
-          echo "Installing Python SDK: ${{ env.BEAM_PYTHON_SDK_TAR_GZ }} with [gcp,yaml] extras"
+          echo "Installing Python SDK: ${BEAM_PYTHON_SDK_TAR_GZ} with [gcp,yaml] extras"
           source beam_env/bin/activate
           # Install from the downloaded tar.gz
-          pip install "${{ env.BEAM_PYTHON_SDK_TAR_GZ }}[gcp,yaml]"
+          pip install "${BEAM_PYTHON_SDK_TAR_GZ}[gcp,yaml]"
           echo "SDK installed."
           pip freeze # Log installed packages
         shell: bash
@@ -158,7 +159,7 @@ jobs:
               - type: WriteToJson
                 config:
                   # Construct the output path directly here
-                  path: "${{ env.GCS_UNIQUE_FOLDER_PREFIX }}/output/out.json"
+                  path: "${GCS_UNIQUE_FOLDER_PREFIX}/output/out.json"
                   num_shards: 100
             windowing:
               type: fixed
@@ -180,8 +181,8 @@ jobs:
             --runner DataflowRunner \
             --region=${{ env.GCE_REGION }} \
             --project=${{ env.GCP_PROJECT_ID }} \
-            --temp_location ${{ env.GCS_UNIQUE_FOLDER_PREFIX }}/temp \
-            --staging_location ${{ env.GCS_UNIQUE_FOLDER_PREFIX }}/staging \
+            --temp_location ${GCS_UNIQUE_FOLDER_PREFIX}/temp \
+            --staging_location ${GCS_UNIQUE_FOLDER_PREFIX}/staging \
             > yaml_dataflow_submit.log 2>&1 &
 
           YAML_DF_PID=$!
@@ -258,7 +259,7 @@ jobs:
               exit 0 # Allow cleanup to proceed
           fi
           # Construct the output path pattern directly here
-          OUTPUT_PATTERN="${{ env.GCS_UNIQUE_FOLDER_PREFIX }}/output/out.json-*-of-*"
+          OUTPUT_PATTERN="${GCS_UNIQUE_FOLDER_PREFIX}/output/out.json-*-of-*"
           echo "Validating GCS output files exist matching pattern: ${OUTPUT_PATTERN}"
           # Wait a bit for cancellation to finalize and files to potentially appear fully
           sleep 60
@@ -277,9 +278,9 @@ jobs:
       - name: Cleanup GCS Temp/Staging and Local Files
         if: always()
         run: |
-          echo "Deleting unique run folder in GCS: ${{ env.GCS_UNIQUE_FOLDER_PREFIX }}"
+          echo "Deleting unique run folder in GCS: ${GCS_UNIQUE_FOLDER_PREFIX}"
           # Delete the entire unique folder for this run, including temp, staging, and output
-          gsutil -m rm -r "${{ env.GCS_UNIQUE_FOLDER_PREFIX }}" || echo "Failed to delete unique run folder ${{ env.GCS_UNIQUE_FOLDER_PREFIX }} in GCS. Manual cleanup might be required."
+          gsutil -m rm -r "${GCS_UNIQUE_FOLDER_PREFIX}" || echo "Failed to delete unique run folder ${GCS_UNIQUE_FOLDER_PREFIX} in GCS. Manual cleanup might be required."
 
           echo "Removing local log, yaml, and jobid files..."
           rm -f yaml_dataflow_submit.log ${{ env.YAML_PIPELINE_FILE }} yaml_dataflow_jobid.txt
diff --git a/.github/workflows/tour_of_beam_backend.yml b/.github/workflows/tour_of_beam_backend.yml
index c61c0607d115..394ca22a5af5 100644
--- a/.github/workflows/tour_of_beam_backend.yml
+++ b/.github/workflows/tour_of_beam_backend.yml
@@ -42,10 +42,13 @@ jobs:
         working-directory: ./learning/tour-of-beam/backend
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           # pin to the biggest Go version supported by Cloud Functions runtime
           go-version: '1.16'
+          cache: false
       - name: Run fmt
         run: |
           go fmt ./...
diff --git a/.github/workflows/tour_of_beam_backend_integration.yml b/.github/workflows/tour_of_beam_backend_integration.yml
index 81dbdfc1b2e9..9adfdb729c77 100644
--- a/.github/workflows/tour_of_beam_backend_integration.yml
+++ b/.github/workflows/tour_of_beam_backend_integration.yml
@@ -77,6 +77,8 @@ jobs:
         working-directory: ./learning/tour-of-beam/backend
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
diff --git a/.github/workflows/tour_of_beam_frontend_test.yml b/.github/workflows/tour_of_beam_frontend_test.yml
index c6df5bf6ea17..bc74ee8f8364 100644
--- a/.github/workflows/tour_of_beam_frontend_test.yml
+++ b/.github/workflows/tour_of_beam_frontend_test.yml
@@ -48,6 +48,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: 'Cache Flutter Dependencies'
         uses: actions/cache@v6
diff --git a/.github/workflows/typescript_tests.yml b/.github/workflows/typescript_tests.yml
index 973f7a8f91ef..401ef1e7aff8 100644
--- a/.github/workflows/typescript_tests.yml
+++ b/.github/workflows/typescript_tests.yml
@@ -143,6 +143,8 @@ jobs:
       gcp-variables-set: ${{ steps.check_gcp_variables.outputs.gcp-variables-set }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: "Check are GCP variables set"
         run: "./scripts/ci/ci_check_are_gcp_variables_set.sh"
         id: check_gcp_variables
diff --git a/.github/workflows/update_python_dependencies.yml b/.github/workflows/update_python_dependencies.yml
index 36752bc3c65a..9da85090c4c7 100644
--- a/.github/workflows/update_python_dependencies.yml
+++ b/.github/workflows/update_python_dependencies.yml
@@ -42,6 +42,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - id: test-properties
         uses: ./.github/actions/setup-default-test-properties
 
@@ -52,6 +54,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
         with:

From e6b5c40ba5fa0139e095d990dbb7965df7947618 Mon Sep 17 00:00:00 2001
From: Derrick Williams <derrickaw@google.com>
Date: Thu, 25 Jun 2026 01:22:47 +0000
Subject: [PATCH 2/3] add rule about action hashes

---
 .github/zizmor.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000000..00ea2bb64bae
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin

From 2a75b9526728b0cec40f80dca5386099f7caceb9 Mon Sep 17 00:00:00 2001
From: Derrick Williams <derrickaw@google.com>
Date: Thu, 25 Jun 2026 01:23:50 +0000
Subject: [PATCH 3/3] add comment

---
 .github/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 00ea2bb64bae..1eb44657382e 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -2,4 +2,4 @@ rules:
   unpinned-uses:
     config:
       policies:
-        "*": ref-pin
+        "*": ref-pin # Allow non-hashed pins, but still require versioned