adopt zizmor (#191)

* adopt `zizmor`

* review actions - revert `fetch-depth`

Author: bjlittle

.github/workflows/ci-manifest.yml

@@ -18,9 +18,9 @@ jobs:
         shell: bash -l {0}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
-          fetch-depth: 0
+          persist-credentials: false
 
       - name: "check-manifest"
         run: |

.github/workflows/ci-release.yml

@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: write
+
 jobs:
   release:
     if: "github.repository_owner == 'SciTools'"
@@ -24,9 +27,9 @@ jobs:
       WF_VERSION_FNAME: "version.txt"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
-          fetch-depth: 0
+          persist-credentials: false
 
       - name: "calculate release version"
         run: |
@@ -50,8 +53,10 @@ jobs:
           echo "WF_VERSION=${WF_VERSION}" >> ${GITHUB_ENV}
 
       - name: "store release version"
+        env:
+          WF_VERSION: ${{ env.WF_VERSION }}
         run: |
-          echo ${{ env.WF_VERSION }} > ${WF_VERSION_FNAME}
+          echo ${WF_VERSION} > ${WF_VERSION_FNAME}
           if [ -n "${WF_BOOTSTRAP}" ]
           then
             git add ${WF_VERSION_FNAME}
@@ -62,6 +67,9 @@ jobs:
           git push
 
       - name: "perform release"
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
-        with:
-          tag_name: ${{ env.WF_VERSION }}
+        env:
+          WF_VERSION: ${{ env.WF_VERSION }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create ${WF_VERSION} --generate-notes
+

.github/workflows/ci-template-check-pr.yml

@@ -6,13 +6,17 @@
 name: ci-template-check-pr
 
 on:
-  pull_request_target:
+  pull_request_target:  # zizmor: ignore[dangerous-triggers]
     branches:
       - main
 
+permissions: {}
+
 jobs:
   prompt-share:
     uses: ./.github/workflows/ci-template-check.yml
-    secrets: inherit
+    secrets: 
+      AUTH_APP_ID: ${{ secrets.AUTH_APP_ID }}
+      AUTH_APP_PRIVATE_KEY: ${{ secrets.AUTH_APP_PRIVATE_KEY }}
     with:
       pr_number: ${{ github.event.pull_request.number }}

.github/workflows/ci-template-check.yml

@@ -5,35 +5,47 @@ name: ci-template-check
 
 on:
   workflow_call:
+    secrets:
+      AUTH_APP_ID:
+        required: true
+      AUTH_APP_PRIVATE_KEY:
+        required: true
     inputs:
       pr_number:
         required: true
         type: number
 
+permissions: {}
+
 jobs:
   prompt-share:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
 
       - name: Checkout SciTools/.github
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           repository: SciTools/.github
           path: SciTools.github
+          persist-credentials: false
 
       - name: Generate Token
         id: generate-token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
         with:
-          app_id: ${{ secrets.AUTH_APP_ID }}
-          private_key: ${{ secrets.AUTH_APP_PRIVATE_KEY }}
+          app-id: ${{ secrets.AUTH_APP_ID }}
+          private-key: ${{ secrets.AUTH_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Set up Python
         # _templating_scripting.py only needs builtins to run.
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
 
       - name: Prompt author to update templates
         id: prompt_author

.github/workflows/refresh-lockfiles.yml

@@ -14,6 +14,13 @@ name: Refresh Lockfiles
 
 on:
   workflow_call:
+    secrets:
+      AUTH_APP_ID:
+        required: true
+      AUTH_APP_PRIVATE_KEY:
+        required: true
+
+permissions: {}
 
 jobs:
   get_python_matrix:
@@ -24,7 +31,10 @@ jobs:
     outputs:
       matrix: ${{ steps.get_py.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
       - id: get_py
         run: echo "MATRIX=$(ls -1 requirements/py*.yml | xargs -n1 basename | sed 's/....$//' | jq -cnR '[inputs]')" >> ${GITHUB_OUTPUT}
 
@@ -40,17 +50,24 @@ jobs:
         python: ${{ fromJSON(needs.get_python_matrix.outputs.MATRIX) }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
       - name: install requirements
         run: |
           source $CONDA/bin/activate base
           conda update -n base --all
+
       - name: generate lockfile
+        env:
+          MATRIX_PYTHON: ${{ matrix.python }}
         run: |
-          pipx run conda-lock -k explicit -p linux-64 -f requirements/${{matrix.python}}.yml
-          mv conda-linux-64.lock ${{matrix.python}}-linux-64.lock
+          pipx run conda-lock -k explicit -p linux-64 -f requirements/${MATRIX_PYTHON}.yml
+          mv conda-linux-64.lock ${MATRIX_PYTHON}-linux-64.lock
+
       - name: output lockfile
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: lock-artifacts-${{matrix.python}}
           path: ${{matrix.python}}-linux-64.lock
@@ -64,19 +81,24 @@ jobs:
     needs: gen_lockfiles
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
       - name: get artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           path: ${{ github.workspace }}/requirements/locks
           merge-multiple: true
 
       - name: "Generate token"
-        uses: actions/create-github-app-token@v3 
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
         id: generate-token
         with:
           app-id: ${{ secrets.AUTH_APP_ID }}
           private-key: ${{ secrets.AUTH_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Create Pull Request
         id: cpr
@@ -98,11 +120,16 @@ jobs:
 
       - name: Check Pull Request
         if: steps.cpr.outputs.pull-request-number != ''
+        env:
+          CPR_PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }} 
+          CPR_PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
+          CPR_PR_OPERATION: ${{ steps.cpr.outputs.pull-request-operation }}
+          CPR_PR_HEAD_SHA: ${{ steps.cpr.outputs.pull-request-head-sha }} 
         run: |
           echo "### :rocket: Pull-Request Summary" >> ${GITHUB_STEP_SUMMARY}
           echo "" >> ${GITHUB_STEP_SUMMARY}
           echo "The following lock-files pull-request has been auto-generated:"
-          echo "- **PR** #${{ steps.cpr.outputs.pull-request-number }}" >> ${GITHUB_STEP_SUMMARY}
-          echo "- **URL** ${{ steps.cpr.outputs.pull-request-url }}" >> ${GITHUB_STEP_SUMMARY}
-          echo "- **Operation** [${{ steps.cpr.outputs.pull-request-operation }}]" >> ${GITHUB_STEP_SUMMARY}
-          echo "- **SHA** ${{ steps.cpr.outputs.pull-request-head-sha }}" >> ${GITHUB_STEP_SUMMARY}
+          echo "- **PR** #${CPR_PR_NUMBER}" >> ${GITHUB_STEP_SUMMARY}
+          echo "- **URL** ${CPR_PR_URL}" >> ${GITHUB_STEP_SUMMARY}
+          echo "- **Operation** [${CPR_PR_OPERATION}]" >> ${GITHUB_STEP_SUMMARY}
+          echo "- **SHA** ${CPR_PR_HEAD_SHA}" >> ${GITHUB_STEP_SUMMARY}