Add Zizmor linter

Apply fixes for new rules

Author: HexDecimal

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
     groups:
       github-actions:
         patterns:
-          - "*"  # Group all Actions updates into a single larger pull request
+          - "*" # Group all Actions updates into a single larger pull request
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/python-package.yml

@@ -16,17 +16,25 @@ defaults:
   run:
     shell: bash
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: pre-commit/action@v3.0.1
 
   mypy:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v6
       - name: Install package
         run: pip install -e ".[test]"
@@ -43,6 +51,8 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15-dev"]
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v6
         name: Setup Python ${{ matrix.python-version }}
         with:
@@ -60,6 +70,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Install build
         run: pip install build
       - name: Build package
@@ -80,7 +92,7 @@ jobs:
       name: pypi
       url: https://pypi.org/project/tcod-ecs/${{ github.ref_name }}/
     permissions:
-      id-token: write
+      id-token: write # Attestation
     steps:
       - uses: actions/download-artifact@v8
         with:
@@ -93,14 +105,15 @@ jobs:
     name: Create Release
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # Publish GitHub Releases
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Generate body
         run: scripts/get_release_description.py | tee release_body.md
       - name: Create Release
         id: create_release
-        uses: ncipollo/release-action@v1
-        with:
-          bodyFile: release_body.md
+        # https://cli.github.com/manual/gh_release_create
+        run: gh release create "${GITHUB_REF_NAME}" --verify-tag --notes-file release_body.md

.github/zizmor.yaml

@@ -0,0 +1,9 @@
+rules:
+  anonymous-definition:
+    disable: true
+  cache-poisoning:
+    disable: true
+  excessive-permissions:
+    disable: true
+  unpinned-uses:
+    disable: true

.pre-commit-config.yaml

@@ -17,8 +17,12 @@ repos:
       - id: fix-byte-order-marker
       - id: detect-private-key
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.9
+    rev: v0.15.14
     hooks:
       - id: ruff-check
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.25.2
+    hooks:
+      - id: zizmor

.vscode/settings.json

@@ -12,6 +12,7 @@
         "buildapi",
         "cattrs",
         "codecov",
+        "cooldown",
         "docstrings",
         "doctest",
         "doctests",
@@ -60,7 +61,8 @@
         "unstructure",
         "WASD",
         "WAXD",
-        "WINDOWLEAVE"
+        "WINDOWLEAVE",
+        "zizmor"
     ],
     "editor.codeActionsOnSave": {
         "source.fixAll": "always"