Add zizmor to prek

Signed-off-by: Bradley Reynolds <bradley.reynolds@tailstory.dev>

Author: shenanigansd

.github/dependabot.yaml

@@ -11,15 +11,21 @@ updates:
     patterns:
       - "*"
     multi-ecosystem-group: "all"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "cargo"
     directory: "/"
     patterns:
       - "*"
     multi-ecosystem-group: "all"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     directory: "/"
     patterns:
       - "*"
     multi-ecosystem-group: "all"
+    cooldown:
+      default-days: 7

.github/workflows/dependency-review.yaml

@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Dependency Review
         uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

.github/workflows/python.yaml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6

.pre-commit-config.yaml

@@ -1,4 +1,9 @@
 repos:
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
     hooks:
@@ -12,4 +17,13 @@ repos:
       - id: mixed-line-ending
         args: [ --fix=lf ]
       - id: end-of-file-fixer
-        exclude: .devcontainer/devcontainer-lock.json
+
+  - repo: https://github.com/astral-sh/uv-pre-commit
+    rev: 8afdb18d56d3bd3edea0c4ddde96965d6894f5f3  # frozen: 0.9.26
+    hooks:
+      - id: uv-lock
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: b546b77c44c466a54a42af5499dcc0dcc1a3193f  # frozen: v1.22.0
+    hooks:
+      - id: zizmor