add zizmor for linting workflows.

.github/workflows/_test.yml

@@ -12,6 +12,8 @@ jobs:
     steps:
       - name: Checkout TUF
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python (oldest supported version)
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
@@ -49,6 +51,8 @@ jobs:
     steps:
       - name: Checkout TUF
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0

.github/workflows/_test_sslib_main.yml

@@ -12,6 +12,8 @@ jobs:
     steps:
       - name: Checkout TUF
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0

.github/workflows/cd.yml

@@ -20,6 +20,7 @@ jobs:
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           ref: ${{ github.event.workflow_run.head_branch }}
 
       - name: Set up Python
@@ -66,8 +67,8 @@ jobs:
             res = await github.rest.repos.createRelease({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              name: '${{ github.ref_name }}-rc',
-              tag_name: '${{ github.ref }}',
+              name: process.env.REF_NAME + '-rc',
+              tag_name: process.env.REF,
               body: fs.readFileSync('changelog', 'utf8'),
             });
 
@@ -81,6 +82,9 @@ jobs:
               });
             });
             return res.data.id
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          REF: ${{ github.ref }}
 
   release:
     name: Release
@@ -108,6 +112,10 @@ jobs:
             github.rest.repos.updateRelease({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              release_id: '${{ needs.candidate_release.outputs.release_id }}',
-              name: '${{ github.ref_name }}',
+              release_id: process.env.RELEASE_ID,
+              name: process.env.REF_NAME,
             })
+
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          RELEASE_ID: ${{ needs.candidate_release.outputs.release_id }}

.github/workflows/codeql-analysis.yml

@@ -24,11 +24,13 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3 # unpinned since this is not security critical
+      uses: github/codeql-action/init@v3 # zizmor: ignore[unpinned-uses]
       with:
         languages: 'python'
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3 # unpinned since this is not security critical
+      uses: github/codeql-action/analyze@v3 # zizmor: ignore[unpinned-uses]

.github/workflows/conformance.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout conformance client
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Run test suite
         uses: theupdateframework/tuf-conformance@9bfc222a371e30ad5511eb17449f68f855fb9d8f # v2.3.0

.github/workflows/dependency-review.yml

@@ -17,5 +17,7 @@ jobs:
     steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4 # unpinned since this is not security critical
+        uses: actions/dependency-review-action@v4 # zizmor: ignore[unpinned-uses]

.github/workflows/maintainer-permissions-reminder.yml

@@ -5,13 +5,14 @@ on:
     - cron: '10 10 10 2 *'
   workflow_dispatch:
 
-permissions:
-  issues: write
+permissions: {}
 
 jobs:
   file-reminder-issue:
     name: File issue to review maintainer permissions
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
     - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
       with:

.github/workflows/scorecards.yml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: "Checkout code"
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: "Run analysis"
         uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
@@ -35,6 +37,6 @@ jobs:
           publish_results: true
 
       - name: "Upload to code-scanning dashboard"
-        uses: github/codeql-action/upload-sarif@v3  # unpinned since this is not security critical
+        uses: github/codeql-action/upload-sarif@v3 # zizmor: ignore[unpinned-uses]
         with:
           sarif_file: results.sarif

.github/workflows/specification-version-check.yml

@@ -15,6 +15,8 @@ jobs:
       version: ${{ steps.get-version.outputs.version }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+         persist-credentials: false
       - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: "3.x"

requirements/lint.txt

@@ -8,6 +8,7 @@
 # are pinned to prevent unexpected linting failures when tools update)
 ruff==0.9.6
 mypy==1.15.0
+zizmor==1.3.1
 
 # Required for type stubs
 freezegun==1.5.1

tox.ini

@@ -42,6 +42,7 @@ commands =
     ruff format --diff {[testenv:lint]lint_dirs}
 
     mypy {[testenv:lint]lint_dirs}
+    zizmor --persona=pedantic -q .
 
 [testenv:fix]
 deps = {[testenv:lint]deps}