chore: now we pass zizmor

Signed-off-by: Henry Schreiner <henryfs@princeton.edu>

Author: henryiii

pyproject.toml

@@ -203,8 +203,7 @@ ignore = [
 "helpers/extensions.py" = ["ANN"]
 
 [tool.repo-review.ignore]
-RTD103 = "Using Ruby instead of Python for docs"
-GH106 = "zizmor adoption for this repo's own workflows is tracked separately"
+RTD103 = "Using MystMD instead of Python for docs"
 
 [tool.typos.default.extend-words]
 nd = "nd"

{{cookiecutter.project_name}}/.github/{% if cookiecutter.__ci == 'github' %}zizmor.yml{% endif %}

@@ -2,7 +2,6 @@
 rules:
   unpinned-uses:
     config:
-      # Actions are kept up to date with Dependabot, so a ref (tag) pin is
-      # sufficient; hash pinning is not required.
+      # Feel free to switch to hash pinning, then this can be removed.
       policies:
         "*": ref-pin