chore: add zizmor

Author: danfimov

.github/workflows/code-check.yml

@@ -18,11 +18,12 @@ permissions:
 
 jobs:
   test:
-    runs-on: ${{ matrix.os }}
+    name: Tests
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        os: [ubuntu-latest] # eventually add `windows-latest` and `macos-latest`
         python-version: [ "3.11", "3.12", "3.13", "3.14" ]
+      fail-fast: true
     services:
       mongodb:
         image: mongo:7
@@ -38,14 +39,13 @@ jobs:
           --health-timeout=5s
           --health-retries=10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - id: setup-uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-          cache-suffix: ${{ matrix.python-version }}
           version: "latest"
           python-version: ${{ matrix.python-version }}
       - name: Install Dependencies

.github/workflows/release.yml

@@ -15,14 +15,15 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - id: setup-uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: false
           python-version: "3.12"
           version: "latest"
       - run: uv version "${GITHUB_REF_NAME}"
       - run: uv build
-      - run: uv publish --trusted-publishing always
+      - run: uv publish --trusted-publishing always  # zizmor: ignore[use-trusted-publishing]

.pre-commit-config.yaml

@@ -6,7 +6,7 @@ repos:
       - id: end-of-file-fixer
 
   - repo: https://github.com/crate-ci/typos
-    rev: v1.38.1
+    rev: v1.50.2
     hooks:
       - id: typos
 
@@ -39,3 +39,12 @@ repos:
           - "check"
           - ./src/taskiq_mongodb
           - ./tests
+
+      - id: zizmor
+        name: zizmor
+        language: python
+        entry: uv run --active --frozen zizmor .
+        files: ^\.github
+        require_serial: true
+        verbose: true
+        pass_filenames: false

pyproject.toml

@@ -48,6 +48,7 @@ dev = [
     "prek>=0.5.3",
     "ruff>=0.16.8",
     "ty>=0.0.81",
+    "zizmor>=1.30.1",
 ]
 test = [
     "pytest>=9.1.1",