fix: add zizmor & harden GitHub Actions workflows

.github/dependabot.yml

@@ -6,24 +6,32 @@ updates:
       interval: "weekly"
     labels:
       - "dependencies"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     directory: "/packages/otdf-python"
     schedule:
       interval: "weekly"
     labels:
       - "dependencies"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     directory: "/packages/otdf-python-proto"
     schedule:
       interval: "weekly"
     labels:
       - "dependencies"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
     labels:
       - "dependencies"
+    cooldown:
+      default-days: 7

.github/workflows/build-python.yaml

@@ -3,17 +3,22 @@ name: "Build Python Wheel"
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04
     outputs:
       wheel: ${{ steps.find_wheel.outputs.wheel_path }}
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"

.github/workflows/lint-pr-title.yaml

@@ -1,7 +1,10 @@
 name: Lint PR Title
 
 on:
-  pull_request_target:
+  # pull_request_target is required so that PRs from forks can be linted.
+  # This is safe here: the workflow never checks out or runs PR code, and
+  # the token is limited to `pull-requests: read`.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
       - edited
@@ -15,7 +18,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/platform-integration-test.yaml

@@ -26,7 +26,9 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Update /etc/hosts
         shell: bash
@@ -48,7 +50,7 @@ jobs:
             up -d
 
       - name: Set up go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.24.x"
           check-latest: false
@@ -102,14 +104,14 @@ jobs:
         shell: bash
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
           python-version: ${{ inputs.python_version }}
 
       - name: Download built wheel
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: python-wheel
           path: dist
@@ -123,7 +125,9 @@ jobs:
           # tests below exercise the actual built artifact rather than an
           # editable install of the checkout.
           uv sync --no-install-workspace
-          uv pip install "${{ inputs.wheel }}"
+          uv pip install "${INPUTS_WHEEL}"
+        env:
+          INPUTS_WHEEL: ${{ inputs.wheel }}
 
       - name: Run all tests, minus integration tests
         env:

.github/workflows/release-please.yaml

@@ -6,27 +6,32 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   # Run full test suite before any release operations
   test-suite:
-    uses: ./.github/workflows/test-suite.yaml
+    permissions:
+      contents: read
+    uses: $/.github/workflows/test-suite.yaml
 
   release-please:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     needs: test-suite
     if: needs.test-suite.outputs.tests_passed == 'true'
     outputs:
       releases_created: ${{ steps.release-main.outputs.releases_created }}
       paths_released: ${{ steps.release-main.outputs.paths_released }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Release-please for main branch (creates stable releases)
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release-main
         with:
           config-file: .release-please-config.json
@@ -44,12 +49,15 @@ jobs:
     if: ${{ needs.release-please.outputs.releases_created == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "latest"
+          enable-cache: false
 
       - name: Build package
         shell: bash
@@ -68,7 +76,7 @@ jobs:
       #   https://pypi.org/manage/project/otdf-python/settings/publishing/
       - name: Publish package distributions to PyPI
         if: github.ref == 'refs/heads/main'
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           # repository-url: https://pypi.org/legacy/
           packages-dir: dist/

.github/workflows/test-suite.yaml

@@ -12,15 +12,20 @@ on:
         value: ${{ jobs.report.outputs.success }}
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   # Step 1: Fast lint and format checks (fail fast on code style)
   lint-check:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -36,10 +41,12 @@ jobs:
     runs-on: ubuntu-22.04
     needs: lint-check
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -57,10 +64,12 @@ jobs:
       wheel: ${{ steps.find_wheel.outputs.wheel_path }}
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -83,7 +92,7 @@ jobs:
         shell: bash
 
       - name: Upload wheel as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: python-wheel
           path: dist/*.whl
@@ -93,10 +102,12 @@ jobs:
     runs-on: ubuntu-22.04
     needs: build
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -113,7 +124,7 @@ jobs:
       matrix:
         python3_version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     needs: [build, unit-tests]
-    uses: ./.github/workflows/platform-integration-test.yaml
+    uses: $/.github/workflows/platform-integration-test.yaml
     with:
       wheel: ${{ needs.build.outputs.wheel }}
       python_version: ${{ matrix.python3_version }}

.github/workflows/zizmor.yaml

@@ -0,0 +1,27 @@
+# Static analysis of GitHub Actions workflows with zizmor.
+# See https://docs.zizmor.sh/
+name: zizmor
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Required to upload SARIF results to GitHub code scanning
+      security-events: write
+    steps:
+      - name: Checkout this repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0

.pre-commit-config.yaml

@@ -45,3 +45,7 @@ repos:
       - id: conventional-pre-commit
         stages: [commit-msg]
         args: [--verbose, feat, fix, docs, style, refactor, perf, revert, build, test, chore, ci]
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.31.1
+    hooks:
+      - id: zizmor