fix: Zizmor

Author: AlejandroFernandezLuces

.github/dependabot.yml

@@ -3,9 +3,9 @@ version: 2
 updates:
   - package-ecosystem: "pip" # See documentation for possible values
     directory: "/"
-    insecure-external-code-execution: allow
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 10
     labels:
       - "maintenance"
       - "dependencies"
@@ -34,3 +34,4 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/ci_cd.yml

@@ -29,8 +29,8 @@ jobs:
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags')
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: write # required to push changes to repository
+      pull-requests: write # required to create pull requests
     steps:
       - uses: ansys/actions/doc-deploy-changelog@41f86da4c9ead510db9135e428e33df9cc6f92e1 # v10.2.3
         with:
@@ -180,8 +180,8 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     permissions:
-      id-token: write
-      contents: write
+      id-token: write # required for release to github
+      contents: write # required to create releases
     steps:
       - name: "Download the library artifacts from build-library step"
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0

.github/workflows/label.yml

@@ -34,7 +34,7 @@ jobs:
         needs: [label-syncer]
         permissions:
           contents: read
-          pull-requests: write
+          pull-requests: write # required to write labels to pull requests
         runs-on: ubuntu-latest
         steps:
         # Label based on modified files
@@ -93,8 +93,8 @@ jobs:
         name: "Create changelog fragment"
         needs: [labeler]
         permissions:
-          contents: write
-          pull-requests: write
+          contents: write # required to push changes to repository
+          pull-requests: write # required to create pull requests
         runs-on: ubuntu-latest
         steps:
         - uses: ansys/actions/doc-changelog@41f86da4c9ead510db9135e428e33df9cc6f92e1 # v10.2.3