From 55811afd5f545063367270e8c9f8ba0800a8937f Mon Sep 17 00:00:00 2001
From: Kamil Vavra <47953210+vavkamil@users.noreply.github.com>
Date: Thu, 26 Mar 2026 11:15:07 +0100
Subject: [PATCH 1/3] chore(security): Pin deps to hash & unify CI templates

---
 .github/workflows/security-zizmor.yml | 18 +++++++++++-------
 .github/workflows/stargazers.yml      |  4 ++++
 .python-version                       |  1 +
 requirements.txt                      |  2 +-
 4 files changed, 17 insertions(+), 8 deletions(-)
 create mode 100644 .python-version

diff --git a/.github/workflows/security-zizmor.yml b/.github/workflows/security-zizmor.yml
index 4ccbb48..d3f83a4 100644
--- a/.github/workflows/security-zizmor.yml
+++ b/.github/workflows/security-zizmor.yml
@@ -1,6 +1,6 @@
 # https://github.com/woodruffw/zizmor
 
-name: Security
+name: Security - zizmor
 
 on:
   push:
@@ -12,23 +12,27 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   zizmor:
-    # name: zizmor via PyPI
-    runs-on: ubuntu-latest
+    # name: zizmor latest via PyPI
+    runs-on: ubuntu-slim
     permissions:
       contents: read
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2 # zizmor: ignore[unpinned-uses]
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6 # zizmor: ignore[unpinned-uses]
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.10.4'
+          python-version-file: '.python-version'
 
       - name: Install Zizmor
         run: |
@@ -36,4 +40,4 @@ jobs:
           pip install $(grep '^zizmor==' requirements.txt)
 
       - name: Run Zizmor
-        run: zizmor .github/workflows
+        run: zizmor --config zizmor.yml .github/workflows
diff --git a/.github/workflows/stargazers.yml b/.github/workflows/stargazers.yml
index 8ab46aa..22baba1 100644
--- a/.github/workflows/stargazers.yml
+++ b/.github/workflows/stargazers.yml
@@ -7,6 +7,10 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   check-new-links:
     runs-on: ubuntu-latest
diff --git a/.python-version b/.python-version
new file mode 100644
index 0000000..da71773
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.14.3
diff --git a/requirements.txt b/requirements.txt
index bdc7be3..37e7b2f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1 @@
-zizmor==1.22.0
+zizmor==1.23.1

From e87437403d16bb5f64b33897ac54903db969940f Mon Sep 17 00:00:00 2001
From: Kamil Vavra <47953210+vavkamil@users.noreply.github.com>
Date: Thu, 26 Mar 2026 11:16:50 +0100
Subject: [PATCH 2/3] fix(ci): No zizmor config

---
 .github/workflows/security-zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-zizmor.yml b/.github/workflows/security-zizmor.yml
index d3f83a4..4bcb4c5 100644
--- a/.github/workflows/security-zizmor.yml
+++ b/.github/workflows/security-zizmor.yml
@@ -40,4 +40,4 @@ jobs:
           pip install $(grep '^zizmor==' requirements.txt)
 
       - name: Run Zizmor
-        run: zizmor --config zizmor.yml .github/workflows
+        run: zizmor .github/workflows

From e94d262f66c098ea579c7069b80d40bd03b5e2a7 Mon Sep 17 00:00:00 2001
From: Kamil Vavra <47953210+vavkamil@users.noreply.github.com>
Date: Thu, 26 Mar 2026 11:18:36 +0100
Subject: [PATCH 3/3] chore(security): Pin deps to hash & unify CI templates

---
 .github/dependabot.yml           | 4 ++--
 .github/workflows/stargazers.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 78ddad7..a576507 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,7 +11,7 @@ updates:
     assignees:
       - "vavkamil"
     cooldown:
-      default-days: 7
+      default-days: 14
 
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -22,4 +22,4 @@ updates:
     assignees:
       - "vavkamil"
     cooldown:
-      default-days: 7
+      default-days: 14
diff --git a/.github/workflows/stargazers.yml b/.github/workflows/stargazers.yml
index 22baba1..c552e40 100644
--- a/.github/workflows/stargazers.yml
+++ b/.github/workflows/stargazers.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2 # zizmor: ignore[unpinned-uses]
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false