William Woodruff 74b1866cee chore(ci): address all lint findings (#206) ...

This addresses a variety of findings, mostly around overly broad default
permissions and credential sharing.

I've also run [pinact](https://github.com/suzuki-shunsuke/pinact) to
auto-hash-pin all action references -- Dependabot will still update
these, but having them hash-pinned will seal off any undesirable
tag/branch mutability 🙂

(99% of these findings were done automatically with `zizmor --fix=all`,
followed by verifying the results. I haven't added a
[zizmor](https://docs.zizmor.sh) workflow as part of this PR, but I'd be
happy to if desired.)

---------

Signed-off-by: William Woodruff <william@astral.sh>

2025-08-20 00:07:37 +02:00

..

codeql-analysis.yml

chore(ci): address all lint findings (#206)

2025-08-20 00:07:37 +02:00

release-drafter.yml

chore(ci): address all lint findings (#206)

2025-08-20 00:07:37 +02:00

test.yml

chore(ci): address all lint findings (#206)

2025-08-20 00:07:37 +02:00

update-known-checksums.yml

chore(ci): address all lint findings (#206)

2025-08-20 00:07:37 +02:00

update-major-minor-tags.yml

chore(ci): address all lint findings (#206)

2025-08-20 00:07:37 +02:00