Add zizmor pre-commit hook

.github/workflows/dependency-review.yaml

@@ -12,6 +12,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Dependency Review
         uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

.github/workflows/python-ci.yaml

@@ -8,7 +8,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
   lint:
@@ -91,6 +90,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     if: ${{ always() }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

.github/workflows/python-publish-pypi.yaml

@@ -22,6 +22,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Build and inspect Python 🐍 package 📦
         uses: hynek/build-and-inspect-python-package@efb823f52190ad02594531168b7a2d5790e66516 # v2.14.0

.pre-commit-config.yaml

@@ -1,14 +1,23 @@
 repos:
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
     hooks:
       - id: check-case-conflict
       - id: check-merge-conflict
       - id: check-toml
       - id: check-yaml
-      - id: check-json
       - id: trailing-whitespace
         args: [ --markdown-linebreak-ext=md ]
       - id: mixed-line-ending
         args: [ --fix=lf ]
       - id: end-of-file-fixer
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: 7fc963270df722f37707d47ff41265fe8f460822  # frozen: v1.20.0
+    hooks:
+      - id: zizmor

noxfile.py

@@ -33,7 +33,7 @@ def tests(session: nox.Session) -> None:
 @nox.session
 def lints(session: nox.Session) -> None:
     """Run lints."""
-    session.run("pre-commit", "run", "--all-files")
+    session.run("prek", "run", "--all-files")
     session.run("ruff", "check", "--fix", ".")
     session.run("ruff", "format", ".")
     session.run("mypy", "--strict", "src/")