Fix CI: resolve all zizmor security audit findings

[tsvikas]

Summary

Add the zizmor pre-commit hook for GitHub Actions security auditing, and fix all findings across both the repo's own workflows and the generated project templates.

Changes

New: zizmor pre-commit hook

• Added zizmor hook to .pre-commit-config.yaml (repo) and .pre-commit-config.yaml.jinja (template)
• Audits GitHub Actions workflows for security issues (unpinned actions, template injection, excessive permissions, etc.)

Repository workflows (.github/)

• Pin actions to SHA hashes in uv-tests.yml and dependabot.yml
• Use static git identity — replace github.actor with template-tester / template-tester@example.com, eliminating the template injection vector entirely
• Add permissions: contents: read — restrict default GITHUB_TOKEN scope (least-privilege)
• Add Dependabot cooldown (default-days: 7)

Generated project templates (project_name/)

• Pin all actions to SHA hashes in ci.yml, weekly-ci.yml, build-and-publish.yml, and deps-update.yml
• Scope issues: write to job level in weekly-ci.yml instead of workflow level
• Add Dependabot cooldown to template dependabot.yml
• Suppress secrets-outside-env for CODECOV_TOKEN — this is a non-sensitive upload token; requiring GitHub Environments would add unnecessary setup burden for generated projects

Findings addressed

Finding	Severity	Fix
unpinned-uses	High	Pin all actions to commit SHAs
template-injection	High	Use static git identity instead of github.actor
excessive-permissions	Medium	Add explicit permissions block; scope issues: write to jobs
dependabot-cooldown	Medium	Add cooldown.default-days: 7
secrets-outside-env	Medium	Inline # zizmor: ignore (deliberate)

https://claude.ai/code/session_013DBSzYMmxuKo9vsjMwXzJQ

[sourcery-ai]

Hey - I've left some high level feedback:

• Setting permissions: {} at the workflow level removes all default GITHUB_TOKEN scopes, which may break actions/checkout (especially on private repos); consider explicitly granting only the minimal required permissions (e.g. permissions: { contents: read }) instead of an empty object.
• Now that actions are pinned, it might be useful to add a brief comment or naming convention around how/when these SHAs should be updated (e.g. via Dependabot) to avoid them silently drifting out of date or being updated manually to tags again.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Setting `permissions: {}` at the workflow level removes all default `GITHUB_TOKEN` scopes, which may break `actions/checkout` (especially on private repos); consider explicitly granting only the minimal required permissions (e.g. `permissions: { contents: read }`) instead of an empty object.
- Now that actions are pinned, it might be useful to add a brief comment or naming convention around how/when these SHAs should be updated (e.g. via Dependabot) to avoid them silently drifting out of date or being updated manually to tags again.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}