Address review

Author: sobolevn

.github/workflows/build_wheels.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          persist-credentials: false
+          persist-credentials: true  # needed to push tags
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'

.github/workflows/mypy_primer.yml

@@ -104,7 +104,6 @@ jobs:
     name: Call mypy_primer_comment workflow
     needs: [join_artifacts]
     permissions:
-      contents: read
       pull-requests: write
     uses: ./.github/workflows/mypy_primer_comment.yml
     with:

.github/workflows/sync_typeshed.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          persist-credentials: true  # needed to `git push` the typeshed
+          persist-credentials: true  # needed to `git push` the PR branch
         # TODO: use whatever solution ends up working for
         # https://github.com/python/typeshed/issues/8434
       - uses: actions/setup-python@v5

.pre-commit-config.yaml

@@ -28,6 +28,11 @@ repos:
           -ignore=property "allow_failure" is not defined,
           -ignore=SC2(046|086),
         ]
+        additional_dependencies:
+          # actionlint has a shellcheck integration which extracts shell scripts in `run:` steps from GitHub Actions
+          # and checks these with shellcheck. This is arguably its most useful feature,
+          # but the integration only works if shellcheck is installed
+          - "github.com/wasilibs/go-shellcheck/cmd/[email protected]"
   - repo: https://github.com/woodruffw/zizmor-pre-commit
     rev: v1.0.0
     hooks: