Add zizmor

.github/workflows/docs.yml

@@ -8,4 +8,6 @@ on:
 
 jobs:
   docs:
-    uses: tskit-dev/.github/.github/workflows/docs.yml@v17
+    permissions:
+      contents: read
+    uses: tskit-dev/.github/.github/workflows/docs.yml@v19

.github/workflows/lint.yml

@@ -6,4 +6,6 @@ on:
 
 jobs:
   lint:
-    uses: tskit-dev/.github/.github/workflows/lint.yml@v17
+    permissions:
+      contents: read
+    uses: tskit-dev/.github/.github/workflows/lint.yml@v19

.github/workflows/python-packaging.yml

@@ -6,6 +6,8 @@ on:
 
 jobs:
   packaging:
-    uses: tskit-dev/.github/.github/workflows/python-packaging.yml@v17
+    permissions:
+      contents: read
+    uses: tskit-dev/.github/.github/workflows/python-packaging.yml@v19
     with:
       pyproject-directory: .

.github/workflows/tests.yml

@@ -9,13 +9,16 @@ on:
 jobs:
   test:
     name: Python
-    uses: tskit-dev/.github/.github/workflows/python-tests.yml@v17
+    permissions:
+      contents: read
+    uses: tskit-dev/.github/.github/workflows/python-tests.yml@v19
     with:
       os: ${{ matrix.os }}
       python-version: ${{ matrix.python }}
       pyproject-directory: .
       coverage-directory: tscompare
-    secrets: inherit
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     strategy:
       matrix:
         python: ["3.11", "3.13"]

.github/workflows/wheels.yml

@@ -6,18 +6,23 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@v6
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
         with:
           version: "0.10.0"
+          enable-cache: false
       - run: uv build
-      - uses: actions/upload-artifact@v4.6.1
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: dist
           path: dist/
@@ -29,18 +34,18 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4.2.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: dist
           path: dist
 
       - name: Publish to Test PyPI
         if: github.event_name == 'push' && github.ref_name == 'test-publish'
-        uses: pypa/gh-action-pypi-publish@v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
         with:
           repository-url: https://test.pypi.org/legacy/
           verbose: true
 
       - name: Publish to PyPI
         if: github.event_name == 'release'
-        uses: pypa/gh-action-pypi-publish@v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0

.github/zizmor.yml

@@ -0,0 +1,9 @@
+# zizmor configuration for tskit-dev repos.
+# Third-party actions must be hash-pinned; first-party tskit-dev reusable
+# workflows are trusted and may stay pinned to a version tag (e.g. @v17).
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        tskit-dev/*: ref-pin
+        "*": hash-pin

prek.toml

@@ -22,7 +22,7 @@ hooks = [
     id = "ruff-check",
     name = "ruff check",
     language = "system",
-    entry = "uv run --group=lint ruff check --fix --force-exclude",
+    entry = "uv run --only-group=lint ruff check --fix --force-exclude",
     types = ["python"],
   },
 ]
@@ -34,7 +34,20 @@ hooks = [
     id = "ruff-format",
     name = "ruff format",
     language = "system",
-    entry = "uv run --group=lint ruff format --force-exclude",
+    entry = "uv run --only-group=lint ruff format --force-exclude",
     types = ["python"],
   },
 ]
+
+[[repos]]
+repo = "local"
+hooks = [
+  {
+    id = "zizmor",
+    name = "zizmor",
+    language = "system",
+    entry = "uv run --only-group=lint zizmor",
+    files = "^\\.github/workflows/.*\\.ya?ml$",
+    pass_filenames = true,
+  },
+]

pyproject.toml

@@ -76,6 +76,7 @@ docs = [
 lint = [
     "ruff==0.15.1",
     "prek==0.3.3",
+    "zizmor==1.26.1",
 ]
 packaging = [
     "twine",