Add zizmor security linter (#468)

Author: hugovk

.github/workflows/main.yml

@@ -53,6 +53,8 @@ jobs:
             experimental: false
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python }}
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       if: "!endsWith(matrix.python, '-dev')"

.github/workflows/mypy.yml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           cache: "pip"

.github/workflows/publish.yml

@@ -16,12 +16,12 @@ jobs:
 
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: '3.x'
-        cache: pip
-        cache-dependency-path: pyproject.toml
     - name: Install dependencies
       run: |
         python -m pip install --upgrade build

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 exclude: ^pyperformance/data-files/
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.13.1
+    rev: v0.15.11
     hooks:
       - id: ruff-check
         name: Run Ruff (lint)
@@ -10,12 +10,33 @@ repos:
         name: Run Ruff (format)
         args: [--exit-non-zero-on-fix]
 
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.37.1
+    hooks:
+      - id: check-dependabot
+      - id: check-github-workflows
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.23.1
+    hooks:
+      - id: zizmor
+
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: v2.6.0
+    rev: v2.21.1
     hooks:
       - id: pyproject-fmt
 
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.24.1
+    rev: v0.25
     hooks:
       - id: validate-pyproject
+
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes

pyperformance/tests/data/bm_local_wheel/pyproject.toml

@@ -1,7 +1,6 @@
 [project]
 name = "pyperformance-bm-local-wheel"
 version = "1.0"
-
 requires-python = ">=3.7"
 classifiers = [
   "Programming Language :: Python :: 3 :: Only",
@@ -12,6 +11,7 @@ classifiers = [
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
 ]
 dependencies = [ "pyperf" ]
 urls = { repository = "https://github.com/python/pyperformance" }

pyproject.toml

@@ -36,10 +36,8 @@
 #  - set version to n+1: pyperformance/__init__.py and doc/conf.py
 #  - git commit -a -m "post-release"
 #  - git push
-
 [build-system]
 build-backend = "setuptools.build_meta"
-
 requires = [ "setuptools>=61" ]
 
 [project]
@@ -69,7 +67,6 @@ dependencies = [
   "pyperf",
   "tomli; python_version<'3.11'",
 ]
-
 optional-dependencies.dev = [
   "mypy==1.20.2",
   "tomli",        # Needed even on 3.11+ for typechecking with mypy
@@ -80,22 +77,15 @@ scripts.pyperformance = "pyperformance.cli:main"
 
 [tool.setuptools]
 include-package-data = true
-
-[tool.setuptools.packages]
-find = {} # Scanning implicit namespaces is active by default
-
-[tool.setuptools.dynamic]
-version = { attr = "pyperformance.__version__" }
+dynamic.version = { attr = "pyperformance.__version__" }
+packages.find = {}  # Scanning implicit namespaces is active by default
 
 [tool.ruff]
 target-version = "py310"
-
 exclude = [
   "pyperformance/data-files/",
 ]
-
 fix = true
-
 lint.select = [
   "E",      # pycodestyle errors
   "F",      # pyflakes errors
@@ -121,13 +111,10 @@ warn_redundant_casts = true
 warn_unused_ignores = true
 warn_unused_configs = true
 files = [
-  'pyperformance/',
+  "pyperformance/",
 ]
 exclude = [
-  'pyperformance/data-files/',
-  'pyperformance/tests/',
+  "pyperformance/data-files/",
+  "pyperformance/tests/",
 ]
-
-[[tool.mypy.overrides]]
-module = "pyperf"
-ignore_missing_imports = true
+overrides = [ { module = "pyperf", ignore_missing_imports = true } ]