feat: add zizmor to pre commit and fix flagged errors

.github/workflows/check-pr-template.yml

@@ -7,4 +7,6 @@ on:
 jobs:
   check-pr-template:
     name: Check PR template
+    permissions:
+      contents: read
     uses: beeware/.github/.github/workflows/pr-checklist.yml@main

.github/workflows/ci.yml

@@ -2,6 +2,9 @@ name: CI
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 # Cancel active CI runs for a PR before starting another run
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -27,12 +30,13 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.X"
           cache: pip

.github/workflows/new-issue.yml

@@ -10,9 +10,11 @@ on:
 jobs:
   add-to-project:
     name: Add issue to BeeWare project
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           project-url: https://github.com/orgs/beeware/projects/1
           github-token: ${{ secrets.BRUTUS_PAT_TOKEN }}

.github/workflows/publish.yml

@@ -27,12 +27,14 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
+
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.X"
           cache: pip
@@ -50,7 +52,7 @@ jobs:
         run: python -m tox -e docs-all
 
       - name: Deploy the built files
-        uses: JamesIves/github-pages-deploy-action@v4.8.0
+        uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0
         with:
           folder: _build/html  # The folder the action should deploy.
           branch: gh-pages  # The branch to which the action should deploy.

.github/workflows/translate.yml

@@ -13,18 +13,23 @@ env:
 
 jobs:
   update-translations:
+    permissions:
+      contents: write
     name: Update Translations
     if: github.repository == 'beeware/beeware.github.io' && github.actor != 'brutusthebee'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        permissions:
+          contents: write
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.X"
           cache: pip

.github/zizmor.yml

@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      # Allow BeeWare-provided actions to be unpinned. If an attacker is in a
+      # position to exploit those action, they're probably able to exploit
+      # repositories directly; and it's significantly easier for our internal
+      # actions to automatically be the most recent versions.
+      policies:
+        beeware/*: ref-pin

.pre-commit-config.yaml

@@ -13,3 +13,7 @@ repos:
     rev: v0.2.43
     hooks:
       - id: rumdl
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.26.1
+    hooks:
+      - id: zizmor