chore: secure CI

.github/dependabot.yml

@@ -4,4 +4,21 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      pre-commit:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

.github/workflows/ack.yml

@@ -6,7 +6,19 @@ on:
   pull_request_target:
     types: [opened, labeled, unlabeled, synchronize]
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   ack:
-    uses: ansible/team-devtools/.github/workflows/ack.yml@main
+    name: Acknowledge pull request
+    # Permissions come from the called workflow; a caller cannot grant less.
+    permissions:
+      checks: write  # required to report the label check
+      contents: write  # required to update the draft release
+      pull-requests: write  # required to comment, approve, and merge
+    uses: ansible/team-devtools/.github/workflows/ack.yml@e7604b7f0f487584a2264c09a0df1524fe2be49e # v26.4.0
     secrets: inherit

.github/workflows/deploy.yml

@@ -9,33 +9,44 @@ on:
     tags:
       - v*
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   dist:
+    name: Build distributions
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
-    - uses: actions/checkout@v7
-    - uses: hynek/build-and-inspect-python-package@v2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
 
   deploy:
+    name: Publish to PyPI
     needs: [dist]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     permissions:
-      id-token: write
-      attestations: write
+      id-token: write  # required to sign the attestation
+      attestations: write  # required to store the attestation
 
     steps:
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: Packages
         path: dist
 
     - name: Generate artifact attestation for sdist and wheel
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
         subject-path: "dist/*"
 
     - name: Publish package
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
       with:
         password: ${{ secrets.pypi_password }}

.github/workflows/format.yml

@@ -6,13 +6,22 @@ on:
     branches:
     - main
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pre-commit:
     name: Pre-commit checks
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-python@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.10'
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/push.yml

@@ -8,6 +8,17 @@ name: push
       - "releases/**"
       - "stable/**"
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   ack:
-    uses: ansible/team-devtools/.github/workflows/push.yml@main
+    name: Update release draft
+    # Permissions come from the called workflow; a caller cannot grant less.
+    permissions:
+      contents: write  # required to update the draft release
+      pull-requests: read  # required to collect the release notes
+    uses: ansible/team-devtools/.github/workflows/push.yml@e7604b7f0f487584a2264c09a0df1524fe2be49e # v26.4.0

.github/workflows/test.yml

@@ -11,11 +11,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   FORCE_COLOR: "1"
 
 jobs:
   test:
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
@@ -30,15 +33,17 @@ jobs:
 
     name: ${{ matrix.os }}, Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
 
-      - uses: astral-sh/setup-uv@v9.0.0
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install tox
         run: uv tool install --with tox-uv tox
@@ -66,10 +71,11 @@ jobs:
     name: All tests passed
     if: always()
     needs: [test]
+    permissions: {}
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Decide whether the needed jobs succeeded or failed
-        uses: re-actors/alls-green@release/v1
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
         with:
           jobs: ${{ toJSON(needs) }}

.github/zizmor.yml

@@ -0,0 +1,17 @@
+rules:
+  # The shared ansible/team-devtools workflow needs pull_request_target to
+  # label and approve pull requests from forks. It does not check out the
+  # pull request code.
+  dangerous-triggers:
+    ignore:
+      - ack.yml
+  # The called workflow reads an optional bot token from the organization
+  # secrets, so the secrets cannot be listed one by one here.
+  secrets-inherit:
+    ignore:
+      - ack.yml
+  # Trusted publishing needs configuration on PyPI, which only a maintainer
+  # can do. Change this in a different pull request.
+  use-trusted-publishing:
+    ignore:
+      - deploy.yml

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: "v6.0.0"
+  rev: "3e8a8703264a2f4a69428a0aa4dcb512790b2c8c"  # frozen: v6.0.0
   hooks:
   - id: check-added-large-files
   - id: check-case-conflict
@@ -14,8 +14,15 @@ repos:
   - id: trailing-whitespace
 
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: "v0.15.17"
+  rev: "39d9ac5938dadb73df0564a45f163e25ff9fa6e2"  # frozen: v0.16.1
   hooks:
   - id: ruff-check
     args: ["--fix"]
   - id: ruff-format
+
+- repo: https://github.com/zizmorcore/zizmor-pre-commit
+  rev: "451b56af716f9f0d0c2b816503a3fd0cf8b036fa"  # frozen: v1.29.0
+  hooks:
+  - id: zizmor
+    files: "^\\.github"
+    args: [--persona=pedantic]

pyproject.toml

@@ -50,6 +50,9 @@ requires = [
 ]
 build-backend = "setuptools.build_meta"
 
+[tool.uv]
+exclude-newer = "7 days"
+
 [tool.ruff]
 show-fixes = true
 lint.extend-select = [