ci: don't persist-credentials on public workflow

.github/workflows/README.md

@@ -17,7 +17,11 @@ Main CI pipeline used to validate code. Based on file changes it calls the follo
 | [`reusable-build.yml`](reusable-build.yml) <br /> [`reusable-build-public.yml`](reusable-build-public.yml)                                                                             | Creates a build zip (used by playground)  |
 | [`reusable-wp-playground-pr-preview.yml`](reusable-wp-playground-pr-preview.yml) <br /> [`reusable-wp-playground-pr-preview-public.yml`](reusable-wp-playground-pr-preview-public.yml) | PR preview environment with wp-playground |
 
-Reusable workflows have a `-public` variant which is used for public GitHub runners. The non-public variants are used for rtCamp's private runners. Ensure that `ci.yml` points to the correct workflows you need, and delete the others.
+Reusable workflows have a `*-public.yml` variant which is used for public GitHub runners and should be used for public repositories. The non-public `*.yml` are meant for private repositories using private runners.
+
+Ensure that `ci.yml` points to the correct workflows you need, and delete the others.
+
+If you are using `ci.yml` in a private repository with rtCamp runners and later steps in the same job need authenticated Git operations, set `persist-credentials: true` in the `actions/checkout` step of `ci.yml`.
 
 ### [`copilot-setup-steps.yml`](copilot-setup-steps.yml)
 

.github/workflows/ci.yml

@@ -39,9 +39,9 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        # Comment this out on private repositories to allow sharing of credentials with subsequent jobs.
-        # with:
-        #  persist-credentials: false
+        # Omit this or set it to true if later steps in this job need authenticated git operations (for example, in private repositories).
+        with:
+          persist-credentials: false
 
       - name: Detect file changes
         uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1

eslint.config.mjs

@@ -43,7 +43,8 @@ export default [
 			'@wordpress/data-no-store-string-literals': 'error',
 			'@wordpress/wp-global-usage': 'error',
 			'@wordpress/react-no-unsafe-timeout': 'error',
-			'@wordpress/use-recommended-components': 'error',
+			// These are not version-stable yet.
+			'@wordpress/use-recommended-components': 'warn',
 
 			// React best practices
 			'react/jsx-boolean-value': 'error',