🐛 fix(ci): unbreak pre-commit and finish zizmor lockdown

.github/dependabot.yaml

@@ -8,3 +8,5 @@ updates:
       actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7

.github/workflows/main.yml

@@ -1,3 +1,5 @@
+name: CI
+
 on:
   pull_request:
   push:
@@ -7,15 +9,15 @@ permissions:
   contents: read
 
 jobs:
-  main-uvx:
+  self-test-uvx:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
     - name: self test action (uvx path)
       uses: ./
-  main-uv-run:
+  self-test-uv-run:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -25,7 +27,7 @@ jobs:
       shell: bash
     - name: self test action (uv run path)
       uses: ./
-  main-external-uv:
+  self-test-external-uv:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.pre-commit-config.yaml

@@ -1,11 +1,10 @@
 repos:
--   repo: https://github.com/pre-commit/pre-commit-hooks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
-    -   id: trailing-whitespace
-    -   id: end-of-file-fixer
-    -   id: check-yaml
-
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
     rev: v1.23.1
     hooks:

action.yml

@@ -19,20 +19,22 @@ runs:
     shell: bash
   - name: Install the latest version of uv
     if: inputs.uv-install == 'true' || (inputs.uv-install == 'auto' && steps.check-uv.outputs.installed != 'true')
-    uses: astral-sh/setup-uv@v7
+    uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
     with:
       enable-cache: true
       cache-dependency-glob: '.pre-commit-config.yaml'
   - run: uv run --isolated --no-sync true && echo "pythonLocation=$(uv python find)" >>$GITHUB_ENV
     shell: bash
-  - uses: actions/cache@v5
+  - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
     with:
       path: ~/.cache/pre-commit
       key: pre-commit-3|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
   - run: |
       if [ -f pyproject.toml ]; then
-        uv run --no-sync --with pre-commit-uv pre-commit run --show-diff-on-failure --color=always ${{ inputs.extra_args }}
+        uv run --no-sync --with pre-commit-uv pre-commit run --show-diff-on-failure --color=always ${INPUTS_EXTRA_ARGS}
       else
-        uvx --with pre-commit-uv pre-commit run --show-diff-on-failure --color=always ${{ inputs.extra_args }}
+        uvx --with pre-commit-uv pre-commit run --show-diff-on-failure --color=always ${INPUTS_EXTRA_ARGS}
       fi
     shell: bash
+    env:
+      INPUTS_EXTRA_ARGS: ${{ inputs.extra_args }}