The .git/config file contains an auth token that can be leaked if the .git directory is included in a workflow artifact.