Fix zizmor findings and add zizmor-action GHA

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     assignees:
       - "rffontenelle"
     commit-message:
@@ -17,6 +19,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     assignees:
       - "rffontenelle"
     commit-message:

.github/workflows/check.yml

@@ -24,10 +24,10 @@ on:
         required: true
         type: string
     secrets:
-      TELEGRAM_TOKEN:
+      telegram_token:
         description: "Token required for interacting with Telegram API"
         required: false
-      TELEGRAM_TO:
+      telegram_to:
         description: "Account ID that will receive the telegram notification"
         required: false
 
@@ -52,12 +52,13 @@ jobs:
       matrix:
         format: [ html, latex, epub ]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: Set up Python 3
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.version }}
           cache: pip
@@ -75,7 +76,7 @@ jobs:
         run: sudo apt update -y && sudo apt install librsvg2-bin -y
 
       - name: Add problem matcher
-        uses: sphinx-doc/github-problem-matcher@v1.1
+        uses: sphinx-doc/github-problem-matcher@1f74d6599f4a5e89a20d3c99aab4e6a70f7bda0f # v1.1
 
       - name: Build docs
         id: build
@@ -93,24 +94,24 @@ jobs:
 
       - name: Notify via Telegram
         if: always() && steps.prepare.outcome == 'success' && github.event_name == 'schedule' && inputs.tx_project == 'python-newest'
-        uses: appleboy/telegram-action@v1.0.1
+        uses: appleboy/telegram-action@221e6b684967abe813051ee4a37dd61770a83ad3 # v1.0.1
         with:
-          to: ${{ secrets.TELEGRAM_TO }}
-          token: ${{ secrets.TELEGRAM_TOKEN }}
+          to: ${{ secrets.telegram_to }}
+          token: ${{ secrets.telegram_token }}
           format: markdown
           disable_web_page_preview: true
           message_file: logs/notify.txt
 
       - name: Upload artifact - log files
         if: always() && steps.build.outcome == 'failure'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: logs-${{ inputs.version }}-${{ matrix.format }}
           path: logs/*
 
       - name: Upload artifact - docs
         if: always() && steps.build.outcome == 'success'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: python-docs-pt-br-${{ inputs.version }}-${{ matrix.format }}
           path: cpython/Doc/build/${{ matrix.format }}
@@ -121,13 +122,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ 'build' ]
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: python-docs-pt-br-${{ inputs.version }}-latex
       - run: sudo apt-get update
       - run: sudo apt-get install -y latexmk texlive-xetex fonts-freefont-otf xindy texlive-lang-portuguese
       - run: make
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         if: always()
         with:
           name: python-docs-pt-br-${{ inputs.version }}-pdf
@@ -139,12 +140,13 @@ jobs:
     name: Lint translations
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: Set up Python 3
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.version }}
           cache: pip
@@ -158,7 +160,7 @@ jobs:
         run: ./scripts/setup.sh
 
       - name: Add problem matcher
-        uses: rffontenelle/sphinx-lint-problem-matcher@v1.0.0
+        uses: rffontenelle/sphinx-lint-problem-matcher@4270bf50b2c93640a7cbb231c09f8e694699af9f #v1.0.0
 
       - name: lint translations files
         id: lint
@@ -176,17 +178,17 @@ jobs:
 
       - name: Notify via Telegram
         if: always() && steps.prepare.outcome == 'success' && github.event_name == 'schedule' && inputs.tx_project == 'python-newest'
-        uses: appleboy/telegram-action@v1.0.1
+        uses: appleboy/telegram-action@221e6b684967abe813051ee4a37dd61770a83ad3 # v1.0.1
         with:
-          to: ${{ secrets.TELEGRAM_TO }}
-          token: ${{ secrets.TELEGRAM_TOKEN }}
+          to: ${{ secrets.telegram_to }}
+          token: ${{ secrets.telegram_token }}
           format: markdown
           disable_web_page_preview: true
           message_file: logs/notify.txt
 
       - name: Upload artifact - log files
         if: always() && steps.lint.outcome == 'failure'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ inputs.version }}-lint-logs
           path: logs/*
@@ -199,9 +201,10 @@ jobs:
     name: Check for zero-width space characters
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.version }}
+          persist-credentials: false
 
       - name: Make sure the repository is up to date
         if: github.event_name != 'pull_request'

.github/workflows/python-310.yml

@@ -8,14 +8,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: '3.10'
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: '3.10'
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}

.github/workflows/python-311.yml

@@ -5,17 +5,27 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: write
+
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: '3.11'
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: '3.11'
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}

.github/workflows/python-312.yml

@@ -8,14 +8,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: '3.12'
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: '3.12'
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}

.github/workflows/python-313.yml

@@ -16,14 +16,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: 3.13
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: 3.13
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}

.github/workflows/python-314.yml

@@ -16,14 +16,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: python-314
       version: 3.14
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: python-314
       version: 3.14
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}

.github/workflows/python-315.yml

@@ -13,17 +13,25 @@ on:
       - main
       - '3.15'
 
+
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: python-newest
       version: 3.15
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: python-newest
       version: 3.15
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}

.github/workflows/python-37.yml

@@ -6,14 +6,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: 3.7
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: 3.7
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}

.github/workflows/python-38.yml

@@ -6,14 +6,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: 3.8
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: 3.8
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}

.github/workflows/python-39.yml

@@ -6,14 +6,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: 3.9
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: 3.9
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}