Improve security of our GitHub Actions

[sobolevn]

Recently CPython introduced this new tool: https://github.com/python/cpython/blob/8eebe4e6d02bb4ad3f1ca6c52624186903dce893/.pre-commit-config.yaml#L64-L67

Which finds different security related problems with GitHub Actions.

I added this tool to our .pre-commit-config.yaml and followed all its recommendations.

Changes:

• I added persist-credentials: false to all checkout actions, see # Whether to configure the token or SSH key with the local git config in https://github.com/actions/checkout
• I moved all permissions from workflow level to job level
• I changed .github/workflows/mypy_primer_comment.yml to be a reusable workflow, see https://woodruffw.github.io/zizmor/audits/#dangerous-triggers

[sobolevn]

CC @hugovk

[AlexWaygood]

Nice, this overall looks great! I'm not familiar with the workflow_call/workflow_run distinction, though, so I haven't looked closely at that. (It looks reasonable, though.)

Another change you might want to make is to list shellcheck as an additional_dependency of actionlint -- I made this change to Ruff's pre-commit config: https://github.com/astral-sh/ruff/blob/0837cdd9314cb9ee1df087142af975d492e3e7ba/.pre-commit-config.yaml#L103-L121. actionlint's shellcheck integration is very useful (it grabs the shell-script strings in GitHub Actions run: steps and passes them to shellcheck), but it's not enabled by default when actionlint is run as part of pre-commit, as actionlint's shellcheck integration only works if shellcheck is already installed.

[github-actions]

According to mypy_primer, this change doesn't affect type check results on a corpus of open source code. ✅

[sobolevn]

Going to do the last ping for reviews :)
Planning to merge this in a couple of days.

[AlexWaygood]

LGTM