diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7170fad..6e2154a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,9 @@ jobs:
     name: Test Node
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       
       - name: Test action with Node.js (npm)
         uses: ./
@@ -48,7 +50,9 @@ jobs:
     name: Test PHP
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       
       - name: Test action with PHP
         uses: ./
@@ -81,10 +85,10 @@ jobs:
     services:
       mongo:
         image: mongo:7
-        ports:
-          - 27017:27017
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Test action with database configuration
         uses: ./
@@ -126,10 +130,10 @@ jobs:
     services:
       mongo:
         image: mongo:7
-        ports:
-          - 27017:27017
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Test action with base modules
         uses: ./
@@ -167,34 +171,25 @@ jobs:
     name: Test Base Modules Requires PHP
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
-
-      - name: Expect failure when install-base-modules is set without install-php
-        id: expect-failure
-        continue-on-error: true
-        uses: ./
+      - uses: actions/checkout@v4
         with:
-          install-node: 'true'
-          install-base-modules: 'true'
-          server-path: './test-server'
-          server-repository: ${{ env.TEST_SERVER_REPOSITORY }}
-          server-ref: ${{ env.TEST_SERVER_REF }}
-          github-server-url: ${{ env.TEST_GIT_SERVER_URL }}
-          checkout-token: ${{ secrets.TEST_SERVER_TOKEN }}
+          persist-credentials: false
 
-      - name: Verify the action failed
+      - name: Verify base modules require PHP
         run: |
-          if [ "${{ steps.expect-failure.outcome }}" != "failure" ]; then
-            echo "::error::Expected action to fail when install-base-modules is set without install-php"
+          if bash ./scripts/validate-inputs.sh true false false true; then
+            echo "::error::Expected validation to fail when install-base-modules is set without install-php"
             exit 1
           fi
-          echo "✓ Action correctly rejected install-base-modules without install-php"
+          echo "✓ Validation correctly rejected install-base-modules without install-php"
 
   test-nginx:
     name: Test nginx
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       
       - name: Test action with nginx
         uses: ./
@@ -220,7 +215,9 @@ jobs:
     name: Test All Components
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       
       - name: Test action with all components
         uses: ./
@@ -262,7 +259,9 @@ jobs:
     name: Test Custom Server Path
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       
       - name: Test action with custom path
         uses: ./
@@ -293,7 +292,9 @@ jobs:
     name: Test Build Command
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       
       - name: Test action with build command
         uses: ./
@@ -309,4 +310,6 @@ jobs:
       - name: Verify build
         run: |
           cd ./test-server
-          npm run dev
+          test -f build.log
+          grep -q '^Build complete$' build.log
+          echo "✓ Custom build command completed successfully"
diff --git a/action.yml b/action.yml
index 3a3d9b8..fddb492 100644
--- a/action.yml
+++ b/action.yml
@@ -123,20 +123,12 @@ runs:
       shell: bash
       run: |
         echo "::group::Validating inputs"
-        
-        # Validate at least one component is enabled
-        if [ "${{ inputs.install-node }}" != "true" ] && \
-           [ "${{ inputs.install-php }}" != "true" ] && \
-           [ "${{ inputs.install-nginx }}" != "true" ]; then
-          echo "::error::At least one component must be enabled (install-node, install-php, or install-nginx)"
-          exit 1
-        fi
 
-        # install-base-modules requires PHP (it runs bin/console)
-        if [ "${{ inputs.install-base-modules }}" == "true" ] && [ "${{ inputs.install-php }}" != "true" ]; then
-          echo "::error::install-base-modules requires install-php to be 'true'"
-          exit 1
-        fi
+        bash "${{ github.action_path }}/scripts/validate-inputs.sh" \
+          "${{ inputs.install-node }}" \
+          "${{ inputs.install-php }}" \
+          "${{ inputs.install-nginx }}" \
+          "${{ inputs.install-base-modules }}"
 
         echo "Server path: ${{ inputs.server-path }}"
         echo "Components to install:"
@@ -156,6 +148,7 @@ runs:
         fetch-depth: 1
         submodules: recursive
         github-server-url: ${{ inputs.github-server-url }}
+        persist-credentials: false
 
     - name: Checkout server repository (with token)
       if: inputs.checkout-token != ''
@@ -168,6 +161,7 @@ runs:
         submodules: recursive
         github-server-url: ${{ inputs.github-server-url }}
         token: ${{ inputs.checkout-token }}
+        persist-credentials: false
 
     - name: Setup Node
       if: inputs.install-node == 'true'
diff --git a/scripts/validate-inputs.sh b/scripts/validate-inputs.sh
new file mode 100644
index 0000000..cdf0a21
--- /dev/null
+++ b/scripts/validate-inputs.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+install_node="${1:-false}"
+install_php="${2:-false}"
+install_nginx="${3:-false}"
+install_base_modules="${4:-false}"
+
+if [ "$install_node" != "true" ] &&
+   [ "$install_php" != "true" ] &&
+   [ "$install_nginx" != "true" ]; then
+  echo "::error::At least one component must be enabled (install-node, install-php, or install-nginx)"
+  exit 1
+fi
+
+if [ "$install_base_modules" = "true" ] && [ "$install_php" != "true" ]; then
+  echo "::error::install-base-modules requires install-php to be 'true'"
+  exit 1
+fi