chore: Sync with WeblateOrg/meta

Author: nijel

.github/workflows/docker.yml

@@ -22,6 +22,8 @@ jobs:
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      with:
+        persist-credentials: false
     - name: Set up QEMU
       uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 

.github/workflows/hadolint.yml

@@ -23,4 +23,6 @@ jobs:
 
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
     - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0

.github/workflows/label-sync.yml

@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
     - uses: srealmoreno/label-sync-action@850ba5cef2b25e56c6c420c4feed0319294682fd # v2.0.0
       with:
         clean-labels: true

.github/workflows/pre-commit.yml

@@ -21,6 +21,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
     - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ~/.cache/pre-commit

.github/workflows/pull_requests.yaml

@@ -6,7 +6,7 @@
 
 name: Pull request automation
 
-on:
+on: # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: opened
 
@@ -23,6 +23,8 @@ jobs:
     if: github.actor == 'weblate'
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
     - name: Enable Pull Request Automerge
       run: gh pr merge --rebase --auto "${{ github.event.pull_request.number }}"
       env:

.pre-commit-config.yaml

@@ -54,5 +54,9 @@ repos:
   rev: 1.19.1
   hooks:
   - id: blacken-docs
+- repo: https://github.com/woodruffw/zizmor-pre-commit
+  rev: v1.6.0
+  hooks:
+  - id: zizmor
 ci:
   autoupdate_schedule: quarterly