Merge branch 'main' into cleanup_checksh

Author: jakkdl

.github/workflows/autodeps.yml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: true  # credentials are needed to push commits
       - name: Setup python
         uses: actions/setup-python@v5
         with:

.github/workflows/check-newsfragment.yml

@@ -15,6 +15,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check newsfragments
         run: |

.github/workflows/ci.yml

@@ -37,6 +37,8 @@ jobs:
 
       - name: Grab the source from Git
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Get the dist version
         id: dist-version
@@ -50,10 +52,11 @@ jobs:
       - name: Set the expected dist artifact names
         id: artifact-name
         run: |
-          echo 'sdist=${{ env.dist-name }}-*.tar.gz' >> "${GITHUB_OUTPUT}"
-          echo 'wheel=${{
-            env.dist-name
-          }}-*-py3-none-any.whl' >> "${GITHUB_OUTPUT}"
+          echo "sdist=${DIST_NAME}-${VERSION}.tar.gz" >> "${GITHUB_OUTPUT}"
+          echo "wheel=${DIST_NAME}-${VERSION}-py3-none-any.whl" >> "${GITHUB_OUTPUT}"
+        env:
+          DIST_NAME: ${{ env.dist-name }}
+          VERSION: ${{ steps.dist-version.outputs.version }}
 
       - name: Install build
         run: python -Im pip install build
@@ -63,8 +66,11 @@ jobs:
       - name: Verify that the artifacts with expected names got created
         run: >-
           ls -1
-          dist/${{ steps.artifact-name.outputs.sdist }}
-          dist/${{ steps.artifact-name.outputs.wheel }}
+          dist/${SDIST}
+          dist/${WHEEL}
+        env:
+          SDIST: ${{ steps.artifact-name.outputs.sdist }}
+          WHEEL: ${{ steps.artifact-name.outputs.wheel }}
       - name: Store the distribution packages
         uses: actions/upload-artifact@v4
         with:
@@ -99,6 +105,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: git-src
+          persist-credentials: false
 
       - name: >-
           Smoke-test: install test requirements from the Git repo
@@ -260,6 +267,8 @@ jobs:
       - name: Grab the source from Git
         if: matrix.check_formatting == '1'
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup python
         uses: actions/setup-python@v5
         with:

.github/workflows/release.yml

@@ -10,6 +10,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.9"

.pre-commit-config.yaml

@@ -38,6 +38,10 @@ repos:
     rev: v1.0.0
     hooks:
       - id: sphinx-lint
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.10.0
+    hooks:
+      - id: zizmor
   - repo: local
     hooks:
       - id: regenerate-files