ci: make ci safe using zizmor (#13397)

Signed-off-by: yihong0618 <zouzou0208@gmail.com>

.github/workflows/api-tests.yml

@@ -26,6 +26,9 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Poetry and Python ${{ matrix.python-version }}
         uses: ./.github/actions/setup-poetry