From 12de339839c8bf60d2874d19ccb7580eb573df90 Mon Sep 17 00:00:00 2001
From: William Durand <will+git@drnd.me>
Date: Tue, 31 Mar 2026 09:54:04 +0200
Subject: [PATCH 1/2] ci: add zizmor workflow

---
 .github/workflows/zizmor.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000..c59f0b8a
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: Zizmor
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Install zizmor
+        run: pip install zizmor==1.22.0
+
+      - name: Run zizmor
+        run: zizmor .github/workflows/
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 95a2911df1e904a199919091d91f5ef6c28802d7 Mon Sep 17 00:00:00 2001
From: William Durand <will+git@drnd.me>
Date: Tue, 31 Mar 2026 10:18:57 +0200
Subject: [PATCH 2/2] ci: fix zizmor issues

---
 .github/workflows/ci.yaml            | 2 ++
 .github/workflows/python.yaml        | 2 ++
 .github/workflows/sync_upstream.yaml | 2 +-
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0e3afebd..f99ca504 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -6,6 +6,8 @@ on:
     branches:
       - amo
 
+permissions: {}
+
 jobs:
   test:
     env:
diff --git a/.github/workflows/python.yaml b/.github/workflows/python.yaml
index 66b5fa5f..598dcbea 100644
--- a/.github/workflows/python.yaml
+++ b/.github/workflows/python.yaml
@@ -20,6 +20,8 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
       with:
         python-version: ${{ matrix.python-version }}
diff --git a/.github/workflows/sync_upstream.yaml b/.github/workflows/sync_upstream.yaml
index 321a06ee..ddb10a5b 100644
--- a/.github/workflows/sync_upstream.yaml
+++ b/.github/workflows/sync_upstream.yaml
@@ -17,7 +17,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           ref: amo
           fetch-depth: 0