Rework project dependencies

.github/dependabot.yaml

@@ -8,6 +8,8 @@ updates:
       github_actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: uv
     directory: /
@@ -17,12 +19,5 @@ updates:
       python:
         patterns:
           - "*"
-
-  - package-ecosystem: pre-commit
-    directory: /
-    schedule:
-      interval: daily
-    groups:
-      pre-commit:
-        patterns:
-          - "*"
+    cooldown:
+      default-days: 7

.github/workflows/linting.yaml

@@ -1,29 +1,34 @@
 name: Linting
-
 on:
-  push:
+  pull_request:
     branches:
       - main
     paths-ignore:
       - docs/**
-  pull_request:
+  push:
     branches:
       - main
     paths-ignore:
       - docs/**
 
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
 env:
   PY_VERSION: '3.10'
+permissions: {}
 
 jobs:
   prek:
     permissions:
       contents: read
-    runs-on: ubuntu-latest
 
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@v7.0.0
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v8.3.2
         with:
           python-version: ${{ env.PY_VERSION }}
       - name: Install project

.github/workflows/publishing.yaml

@@ -1,54 +1,46 @@
 name: Publishing
+on: push
 
-on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - docs/**
-    tags:
-      - "[0-9]+.[0-9]+.[0-9]+"
-  pull_request:
-    branches:
-      - main
-    paths-ignore:
-      - docs/**
-
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
 env:
-  PY_VERSION: 3.14
+  PY_VERSION: '3.14'
+permissions: {}
 
 jobs:
   build:
     permissions:
       contents: read
-    runs-on: ubuntu-latest
 
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@v7.0.0
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v8.3.2
         with:
           python-version: ${{ env.PY_VERSION }}
       - name: Install project
         run: uv sync --locked --no-dev
       - name: Run build
         run: uv build
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: python-package-distributions
           path: dist/
 
   validate:
     needs:
       - build
-    permissions: {}
-    runs-on: ubuntu-latest
 
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@v8.0.1
         with:
           name: python-package-distributions
           path: dist/
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@v8.3.2
         with:
           python-version: ${{ env.PY_VERSION }}
       - name: Validate dist
@@ -57,17 +49,17 @@ jobs:
   publish:
     environment:
       name: pypi
-      url: https://pypi.org/p/perdoo
+      url: 'https://pypi.org/p/perdoo'
     if: startsWith(github.ref, 'refs/tags/')
     needs:
       - build
       - validate
     permissions:
       id-token: write
-    runs-on: ubuntu-latest
 
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@v8.0.1
         with:
           name: python-package-distributions
           path: dist/

.github/workflows/rich-codex.yaml

@@ -1,14 +1,13 @@
 name: Rich Codex
-
 on:
-  push:
+  pull_request:
     branches:
       - main
     paths:
       - .github/workflows/rich-codex.yaml
       - README.md
       - perdoo/cli/**
-  pull_request:
+  push:
     branches:
       - main
     paths:
@@ -17,18 +16,24 @@ on:
       - perdoo/cli/**
   workflow_dispatch:
 
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
 env:
-  PY_VERSION: "3.10"
+  PY_VERSION: '3.10'
+permissions: {}
 
 jobs:
   rich_codex:
     permissions:
       contents: write
-    runs-on: ubuntu-latest
 
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@v7.0.0
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v8.3.2
         with:
           python-version: ${{ env.PY_VERSION }}
       - name: Install project

.github/workflows/testing.yaml

@@ -1,44 +1,45 @@
 name: Testing
-
 on:
-  push:
+  pull_request:
     branches:
       - main
     paths-ignore:
       - docs/**
-  pull_request:
+  push:
     branches:
       - main
     paths-ignore:
       - docs/**
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+permissions: {}
 
 jobs:
   pytest:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
-        python-version:
-          - "3.10"
-          - "3.11"
-          - "3.12"
-          - "3.13"
-          - "3.14"
         os:
           - ubuntu-latest
           - macos-latest
           - windows-latest
+        python-version:
+          - '3.10'
+          - '3.11'
+          - '3.12'
+          - '3.13'
+          - '3.14'
 
-    permissions:
-      contents: read
     runs-on: ${{ matrix.os }}
-
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@v7.0.0
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v8.3.2
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install project
@@ -50,11 +51,9 @@ jobs:
     if: always()
     needs:
       - pytest
-    permissions: {}
-    runs-on: ubuntu-latest
 
+    runs-on: ubuntu-latest
     steps:
-      - name: Check for failures
-        uses: re-actors/alls-green@v1.2.2
+      - uses: re-actors/alls-green@v1.2.2
         with:
           jobs: ${{ toJSON(needs) }}

.github/zizmor.yaml

@@ -0,0 +1,20 @@
+rules:
+  unpinned-uses:
+    ignore:
+      - linting.yaml
+      - rich-codex.yaml
+      - testing.yaml
+      - publishing.yaml
+  anonymous-definition:
+    ignore:
+      - 'linting.yaml:22'
+      - 'publishing.yaml:12'
+      - 'publishing.yaml:33'
+      - 'publishing.yaml:49'
+      - 'rich-codex.yaml:27'
+      - 'testing.yaml:20'
+      - 'testing.yaml:50'
+  undocumented-permissions:
+    ignore:
+      - 'publishing.yaml:58'
+      - 'rich-codex.yaml:29'

.gitignore

@@ -2,6 +2,7 @@
 __pycache__/
 __pypackages__/
 .idea/
+.pytest_cache/
 .ruff_cache/
 .tox/
 .venv/