Add zizmor checks and fix all lints

.github/dependabot.yml

@@ -13,3 +13,14 @@ updates:
       github-actions:
         patterns:
           - '*'
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "Bot"
+    cooldown:
+      default-days: 7

.github/workflows/deploy-docs.yml

@@ -22,14 +22,17 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    env:
+      REF_NAME: ${{ github.ref_name }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         init-shell: bash
@@ -45,28 +48,29 @@ jobs:
       run: |
         set -e
         pushd docs
+
         make clean html linkcheck
         popd
 
     - name: Update switcher and latest version
       if: ${{ github.event_name == 'release' }}
       run: |
-        python docs/update_switcher.py --version ${{ github.ref_name }}
+        python docs/update_switcher.py --version $REF_NAME
 
     - name: Create PR
       if: ${{ github.event_name == 'release' }}
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
       with:
-        commit-message: "docs: Update switcher.json for ${{ github.ref_name }}"
-        title: "docs: Update switcher.json for ${{ github.ref_name }}"
+        commit-message: "docs: Update switcher.json for $REF_NAME"
+        title: "docs: Update switcher.json for $REF_NAME"
         body: "This PR updates the switcher.json file."
-        branch: "docs/update-switcher-${{ github.ref_name }}"
+        branch: "docs/update-switcher-$REF_NAME"
         base: "main"
         labels: "documentation"
 
     - name: Publish to Github Pages on main
       if: ${{ github.ref == 'refs/heads/main' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
@@ -75,15 +79,15 @@ jobs:
 
     - name: Publish to Github Pages on release (versioned)
       if: ${{ github.event_name == 'release' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
-        destination_dir: ${{ github.ref_name }}
+        destination_dir: $REF_NAME
 
     - name: Publish to Github Pages on release (latest)
       if: ${{ github.event_name == 'release' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/

.github/workflows/pypi.yml

@@ -18,18 +18,27 @@ defaults:
 jobs:
   packages:
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/folium/
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        # Should be enough for setuptools-scm
+        fetch-depth: 100
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: "3.x"
 
     - name: Get tags
       run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
 
-
     - name: Install build tools
       run: |
         python -m pip install --upgrade pip wheel build twine
@@ -48,7 +57,4 @@ jobs:
 
     - name: Publish a Python distribution to PyPI
       if: success() && github.event_name == 'release'
-      uses: pypa/gh-action-pypi-publish@v1.14.1
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_PASSWORD }}
+      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # v1.14.1

.github/workflows/save_versions.yml

@@ -1,5 +1,8 @@
 name: Save package versions
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -9,13 +12,18 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
 
     steps:
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -36,7 +44,7 @@ jobs:
 
     - name: Save versions.txt
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: versions.txt
         path: /tmp/versions.txt

.github/workflows/test_code.yml

@@ -1,5 +1,8 @@
 name: Code Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -11,22 +14,27 @@ on:
 jobs:
   run:
     runs-on: ${{ matrix.os }}
+    permissions:
+      actions: write
+
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        python-version: ["3.9", "3.13"]
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
+        python-version: [ "3.10", "3.14" ]
       fail-fast: false
     defaults:
       run:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
-        micromamba-version: '2.6.0-0'
         environment-name: TEST
         create-args: >-
           python=${{ matrix.python-version }}
@@ -48,7 +56,7 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-code-${{ matrix.os }}-${{ matrix.python-version }}
         path: .coverage*

.github/workflows/test_geopandas.yml

@@ -1,5 +1,8 @@
 name: Geopandas tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -11,29 +14,34 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+
     defaults:
       run:
         shell: bash -l {0}
 
     steps:
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
-        # needed to get the correct version number for Folium
         fetch-depth: 0
+        persist-credentials: false
         path: folium
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
           python=3.13
           --file folium/requirements.txt
 
     - name: Checkout Geopandas
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
+        fetch-depth: 0
+        persist-credentials: false
         repository: geopandas/geopandas
         path: geopandas
 
@@ -54,7 +62,7 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-geopandas
         path: |

.github/workflows/test_latest_branca.yml

@@ -1,5 +1,8 @@
 name: Code Tests with Latest branca
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -16,10 +19,13 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -38,9 +44,11 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-branca
         path: |
           .coverage*
         include-hidden-files: true
+      permissions:
+        actions: write

.github/workflows/test_mypy.yml

@@ -1,5 +1,9 @@
 name: Mypy type hint checks
 
+# no permissions by default
+permissions: {}
+
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -16,10 +20,13 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-

.github/workflows/test_selenium.yml

@@ -1,5 +1,8 @@
 name: Selenium Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -13,17 +16,22 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [ "3.9", "3.13" ]
+        python-version: [ "3.9", "3.14" ]
       fail-fast: false
     defaults:
       run:
         shell: bash -l {0}
+    permissions:
+      actions: write
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -39,7 +47,7 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-selenium-${{ matrix.python-version }}
         path: |