From d0bdc3d1a8016b83d070d4326543a5c94458a72b Mon Sep 17 00:00:00 2001
From: Adam Dangoor <adamdangoor@gmail.com>
Date: Mon, 29 Dec 2025 13:07:41 +0000
Subject: [PATCH 1/3] Add zizmor for GitHub Actions security linting

---
 .pre-commit-config.yaml | 10 ++++++++++
 pyproject.toml          |  1 +
 2 files changed, 11 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b6bd8e18f..610a8ad0d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -38,6 +38,7 @@ ci:
     - vulture
     - vulture-docs
     - yamlfix
+    - zizmor
     - pyrefly
     - pyrefly-docs
 
@@ -384,6 +385,15 @@ repos:
         additional_dependencies: [uv==0.9.5]
         stages: [pre-commit]
 
+      - id: zizmor
+        name: zizmor
+        entry: uv run --extra=dev zizmor .github
+        language: python
+        pass_filenames: false
+        types_or: [yaml]
+        additional_dependencies: [uv==0.9.5]
+        stages: [pre-commit]
+
       - id: sphinx-lint
         name: sphinx-lint
         entry: uv run --extra=dev sphinx-lint --enable=all --disable=line-too-long
diff --git a/pyproject.toml b/pyproject.toml
index e14c7285f..7d16625de 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -106,6 +106,7 @@ optional-dependencies.dev = [
     "vws-test-fixtures==2023.3.5",
     "vws-web-tools==2024.10.6.1",
     "yamlfix==1.19.1",
+    "zizmor==1.19.0",
 ]
 optional-dependencies.release = [ "check-wheel-contents==0.6.3" ]
 urls.Documentation = "https://vws-python.github.io/vws-python-mock/"

From 04bb67aea0b81578f5ae0367d14cdff01a92f0c8 Mon Sep 17 00:00:00 2001
From: Adam Dangoor <adamdangoor@gmail.com>
Date: Mon, 29 Dec 2025 16:30:53 +0000
Subject: [PATCH 2/3] Add zizmor config and ignore in check-manifest

---
 pyproject.toml |  1 +
 zizmor.yml     | 12 ++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 zizmor.yml

diff --git a/pyproject.toml b/pyproject.toml
index 7d16625de..b5ae019fa 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -327,6 +327,7 @@ ignore = [
     "lint.mk",
     "src/mock_vws/_flask_server/Dockerfile",
     "secrets.tar.gpg",
+    "zizmor.yml",
 ]
 
 [tool.deptry]
diff --git a/zizmor.yml b/zizmor.yml
new file mode 100644
index 000000000..f63e179d2
--- /dev/null
+++ b/zizmor.yml
@@ -0,0 +1,12 @@
+---
+rules:
+  unpinned-uses:
+    disable: true
+  cache-poisoning:
+    disable: true
+  bot-conditions:
+    disable: true
+  dependabot-cooldown:
+    disable: true
+  template-injection:
+    disable: true

From d8ec26c8da31ca83e33e9bce7dd4950547e0e87a Mon Sep 17 00:00:00 2001
From: Adam Dangoor <adamdangoor@gmail.com>
Date: Mon, 29 Dec 2025 17:01:48 +0000
Subject: [PATCH 3/3] Fix zizmor issues in GitHub workflows

---
 .github/workflows/docker-build.yml |  4 ++++
 .github/workflows/lint.yml         |  4 ++++
 .github/workflows/release.yml      |  1 +
 .github/workflows/test.yml         | 10 ++++++++++
 4 files changed, 19 insertions(+)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 63e9b6d26..69e8d7b2b 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -17,6 +17,8 @@ on:
     - cron: 0 1 * * *
   workflow_dispatch: {}
 
+permissions: {}
+
 jobs:
   build:
     name: Build Docker images
@@ -32,6 +34,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+        with:
+          persist-credentials: false
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 5127a1bbc..ae75ee351 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,6 +13,8 @@ on:
     - cron: 0 1 * * *
   workflow_dispatch: {}
 
+permissions: {}
+
 jobs:
   build:
 
@@ -26,6 +28,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9cd203fa1..a078bd334 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,6 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
+          persist-credentials: false
           # Fetch all history including tags.
           # Needed to find the latest tag.
           #
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 992027cdc..437ad5fde 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,6 +16,8 @@ on:
 # workflows. We therefore want to run only one workflow at a time.
 concurrency: vuforia_credentials
 
+permissions: {}
+
 jobs:
   # CI tests with matrix
   ci-tests:
@@ -118,6 +120,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -187,6 +191,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -230,6 +236,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -270,6 +278,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with: