Address zizmor findings and lock all dependencies

.github/dependabot.yml

@@ -37,3 +37,15 @@ updates:
       - lopopolo
     labels:
       - A-deps
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      pip-deps:
+        patterns:
+          - "*"
+    assignees:
+      - lopopolo
+    labels:
+      - A-deps

.github/workflows/audit.yaml

@@ -9,14 +9,17 @@ name: Audit
       - trunk
   schedule:
     - cron: "0 0 * * TUE"
+permissions: {}
 jobs:
   ruby:
     name: Audit Ruby Dependencies
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Ruby toolchain
         uses: ruby/setup-ruby@2654679fe7f7c29875c669398a8ec0791b8a64a1 # v1.215.0

.github/workflows/block-merge.yaml

@@ -3,10 +3,14 @@ name: Merge
 "on":
   pull_request:
     types: [opened, labeled, unlabeled, synchronize]
+permissions: {}
 jobs:
   labels:
     name: Labels
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
 
     steps:
       - uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5.5

.github/workflows/ci.yaml

@@ -9,6 +9,7 @@ name: CI
       - trunk
   schedule:
     - cron: "0 0 * * TUE"
+permissions: {}
 jobs:
   build:
     name: Build
@@ -29,7 +30,10 @@ jobs:
             dockerfile: ubuntu/jammy/Dockerfile
 
     steps:
-      - uses: actions/checkout@v4.2.2
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
@@ -46,32 +50,33 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Lint Ubuntu Dockerfile
-        uses: docker://hadolint/hadolint:latest
+        uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
         with:
-          entrypoint: /bin/hadolint
-          args: --config /github/workspace/.hadolint.yaml /github/workspace/ubuntu/jammy/Dockerfile
+          dockerfile: ubuntu/jammy/Dockerfile
 
       - name: Lint Debian Slim Dockerfile
-        uses: docker://hadolint/hadolint:latest
+        uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
         with:
-          entrypoint: /bin/hadolint
-          args: --config /github/workspace/.hadolint.yaml /github/workspace/debian/bookworm/slim/Dockerfile
+          dockerfile: debian/bookworm/slim/Dockerfile
 
       - name: Lint Alpine Dockerfile
-        uses: docker://hadolint/hadolint:latest
+        uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
         with:
-          entrypoint: /bin/hadolint
-          args: --config /github/workspace/.hadolint.yaml /github/workspace/alpine/Dockerfile
+          dockerfile: alpine/Dockerfile
 
   ruby:
     name: Lint and format Ruby
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Ruby toolchain
         uses: ruby/setup-ruby@2654679fe7f7c29875c669398a8ec0791b8a64a1 # v1.215.0
@@ -87,10 +92,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5.2.2
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        run: uv python install
 
       - name: Setup Node.js runtime
-        uses: actions/setup-node@v4.2.0
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: "lts/*"
 
@@ -101,8 +116,4 @@ jobs:
         run: npx prettier --check '**/*'
 
       - name: Lint YAML sources with yamllint
-        run: |
-          yamllint --version
-          echo "Linting YAML sources with yamllint ..."
-          yamllint --strict --format github .
-          echo "OK"
+        run: uv run yamllint --strict --format github .

.github/workflows/docker-nightly.yaml

@@ -9,7 +9,7 @@ name: Docker Nightly Builder
       - trunk
   schedule:
     - cron: "0 0 * * *" # build nightly!
-
+permissions: {}
 jobs:
   nightly:
     name: Nightly
@@ -42,13 +42,17 @@ jobs:
             tag_version: ubuntu-jammy
 
     steps:
-      - uses: actions/checkout@v4.2.2
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Clone Artichoke
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: artichoke/artichoke
           path: artichoke
+          persist-credentials: false
 
       - name: Set Artichoke latest commit
         id: latest
@@ -57,10 +61,14 @@ jobs:
           echo "Artichoke git ref: $(git rev-parse HEAD)"
           echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
-      - name: Setup Python
-        uses: actions/setup-python@v5.4.0
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5.2.2
         with:
-          python-version: "3.11"
+          version: "latest"
+          enable-cache: false
+
+      - name: Set up Python
+        run: uv python install
 
       - name: Set Artichoke Rust toolchain version
         id: rust_toolchain
@@ -99,7 +107,7 @@ jobs:
               print(f"build_timestamp={build_timestamp}", file=f)
 
       - name: Generate THIRDPARTY license listing
-        uses: artichoke/generate_third_party@v1.15.0
+        uses: artichoke/generate_third_party@4da01edc4b60228846ab2949292044fc55bfb193 # v1.15.0
         with:
           artichoke_ref: ${{ steps.latest.outputs.commit }}
           target_triple: ${{ matrix.target_triple }}
@@ -111,6 +119,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
+        with:
+          cache-binary: false
 
       - name: Login to DockerHub
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0

.github/workflows/repo-labels.yaml

@@ -15,12 +15,18 @@
   schedule:
     - cron: "0 0 * * TUE"
 name: Create Repository Labels
+permissions: {}
 jobs:
   labels:
     name: Synchronize repository labels
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Sync GitHub Issue Labels
         uses: crazy-max/ghaction-github-labeler@31674a3852a9074f2086abcf1c53839d466a47e7 # v5.2.0

.github/workflows/toolchain-version-check.yaml

@@ -4,14 +4,17 @@ name: Toolchain Version Check
   schedule:
     - cron: "0 5 * * 5" # 5am UTC Fridays. Rust toolchain versions merge Thursday afternoons.
   workflow_dispatch:
-
+permissions: {}
 jobs:
   check-toolchain-version:
     name: Check toolchain version
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4.2.2
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Ruby toolchain
         uses: ruby/setup-ruby@2654679fe7f7c29875c669398a8ec0791b8a64a1 # v1.215.0

.python-version

@@ -0,0 +1 @@
+3.13

Rakefile

@@ -8,10 +8,15 @@ require 'rubocop/rake_task'
 task default: %i[format lint]
 
 desc 'Lint sources'
-task lint: %i[lint:rubocop:autocorrect]
+task lint: %i[lint:rubocop:autocorrect lint:yaml]
 
 namespace :lint do
   RuboCop::RakeTask.new(:rubocop)
+
+  desc 'Lint YAML sources with yamllint'
+  task :yaml do
+    sh 'uv run yamllint --strict .'
+  end
 end
 
 desc 'Format sources'

pyproject.toml

@@ -0,0 +1,13 @@
+[project]
+name = "docker-artichoke-nightly"
+version = "0"
+license = { file = "LICENSE" }
+classifiers = ["Private :: Do Not Upload"]
+readme = "README.md"
+requires-python = ">=3.13"
+dependencies = []
+
+[dependency-groups]
+dev = [
+    "yamllint>=1.35.1",
+]