Harden CI (#711)

same as marshmallow-code/marshmallow#2952

Author: sloria

.github/workflows/build-release.yml

@@ -4,6 +4,8 @@ on:
     branches: ["dev"]
     tags: ["*"]
   pull_request:
+permissions:
+  contents: read
 jobs:
   tests:
     name: ${{ matrix.name }}
@@ -20,17 +22,21 @@ jobs:
           - { name: "mypy-madev", tox: mypy-marshmallowdev }
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with: # zizmor: ignore[cache-poisoning] cache key is lockfile-derived
           enable-cache: true
       - run: uv run tox -e${{ matrix.tox }}
   build:
     name: Build package
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with: # zizmor: ignore[cache-poisoning] cache key is lockfile-derived
           enable-cache: true
       - run: uv build
       - run: uvx twine check --strict dist/*
@@ -46,8 +52,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with: # zizmor: ignore[cache-poisoning] cache key is lockfile-derived
           enable-cache: true
       - run: uv run tox -e lint
   publish-to-pypi:

.pre-commit-config.yaml

@@ -11,6 +11,10 @@ repos:
   hooks:
     - id: check-github-workflows
     - id: check-readthedocs
+- repo: https://github.com/zizmorcore/zizmor-pre-commit
+  rev: v1.24.0
+  hooks:
+    - id: zizmor
 - repo: https://github.com/asottile/blacken-docs
   rev: 1.20.0
   hooks: