Switch to my composite actions and add Zizmor

This removes code duplication.

Author: pgjones

.github/workflows/ci.yml

@@ -6,10 +6,18 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   tox:
     name: ${{ matrix.name }}
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    container: python:${{ matrix.python }}
+
     strategy:
       fail-fast: false
       matrix:
@@ -25,25 +33,18 @@ jobs:
           - {name: 'package', python: '3.14', tox: package}
 
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
+      - uses: pgjones/actions/tox@dbbee601c084d000c4fc711d4b27cb306e15ead1 # v1
         with:
-          python-version: ${{ matrix.python }}
-
-      - name: update pip
-        run: |
-          pip install -U wheel
-          pip install -U setuptools
-          python -m pip install -U pip
-      - run: pip install tox
-
-      - run: tox -e ${{ matrix.tox }}
+          environment: ${{ matrix.tox }}
 
 
   h2spec:
     name: ${{ matrix.name }}
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:
@@ -53,6 +54,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
@@ -80,6 +83,10 @@ jobs:
   autobahn:
     name: ${{ matrix.name }}
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:
@@ -89,6 +96,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
@@ -107,3 +116,13 @@ jobs:
       - name: Run Unit Tests
         working-directory: compliance/autobahn
         run: docker run --rm --network=host -v "${PWD}/:/config" -v "${PWD}/reports:/reports" --name fuzzingclient crossbario/autobahn-testsuite wstest -m fuzzingclient -s /config/fuzzingclient.json && python3 summarise.py
+
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: pgjones/actions/zizmor@dbbee601c084d000c4fc711d4b27cb306e15ead1 # v1

.github/workflows/publish.yml

@@ -3,22 +3,18 @@ on:
   push:
     tags:
       - '*'
+
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
 
-      - uses: actions/setup-python@v3
-        with:
-          python-version: 3.14
+    permissions:
+      contents: read
 
-      - run: |
-          pip install pdm
-          pdm build
-      - uses: actions/upload-artifact@v3
-        with:
-          path: ./dist
+    steps:
+      - uses: pgjones/actions/build@dbbee601c084d000c4fc711d4b27cb306e15ead1 # v1
 
   pypi-publish:
     needs: ['build']
@@ -30,9 +26,9 @@ jobs:
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
         with:
           packages_dir: artifact/