chore: Make Dependabot less noisy and guard against supply chain attacks

.github/dependabot.yml

@@ -4,9 +4,33 @@ updates:
   - package-ecosystem: pip
     directory: "/"
     schedule:
-      interval: daily
+      interval: monthly
+    cooldown:
+      default-days: 7
+    groups:
+      docs:
+        patterns:
+          - "sphinx*"
+      tests:
+        patterns:
+          - "pytest*"
+          - "coverage"
+      linters:
+        patterns:
+          - "mypy"
+          - "basedpyright"
+          - "ruff"
+          - "ty"
+          - "tox*"
+          - "zizmor"
 
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: daily
+      interval: monthly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -6,13 +6,18 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: hynek/build-and-inspect-python-package@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - uses: hynek/build-and-inspect-python-package@d44ca7d91762de7a7d5436ddae667c6da6d1c3df # v2
 
   tests:
     strategy:
@@ -53,21 +58,26 @@ jobs:
           - name: "ty"
             python: "3.14"
             tox: ty
+          - name: "zizmor"
+            python: "3.14"
+            tox: zizmor
 
     name: ${{ matrix.name }}
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           python-version: ${{ matrix.python }}
       - run: uv tool install tox --with tox-uv
       - run: tox -e ${{ matrix.tox }}
         if: ${{ ! matrix.coverage }}
       - run: tox -e ${{ matrix.tox }} -- --cov-report=xml
         if: ${{ matrix.coverage }}
-      - uses: codecov/codecov-action@v6
+      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
         if: ${{ matrix.coverage }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/release.yml

@@ -13,11 +13,13 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: hynek/build-and-inspect-python-package@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - uses: hynek/build-and-inspect-python-package@d44ca7d91762de7a7d5436ddae667c6da6d1c3df # v2
         id: build
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: ${{ steps.build.outputs.artifact-name }}
           path: dist
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

pyproject.toml

@@ -29,6 +29,7 @@ dev = [
     { include-group = "ruff" },
     { include-group = "tests" },
     { include-group = "ty" },
+    { include-group = "zizmor" },
 ]
 docs = [
     "sphinx>=5.3",
@@ -46,6 +47,7 @@ tests = [
     "pytest-watcher>=0.4.3",
 ]
 ty = ["ty==0.0.37"]
+zizmor = ["zizmor==1.25.2"]
 
 
 [tool.coverage.paths]
@@ -125,6 +127,7 @@ env_list = [
     "ruff-format",
     "ruff-lint",
     "ty",
+    "zizmor",
 ]
 
 [tool.tox.env_run_base]
@@ -202,6 +205,11 @@ commands = [
     ],
 ]
 
+[tool.tox.env.zizmor]
+skip_install = true
+dependency_groups = ["zizmor"]
+commands = [["zizmor", "{posargs:.}"]]
+
 
 [build-system]
 requires = ["hatchling"]