From 88852350918af9a30b27570db5bf1927e490171f Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Wed, 19 Feb 2025 12:48:36 +0200
Subject: [PATCH 1/2] Add zizmor to pre-commit and fix warnings

---
 .github/workflows/lint.yml | 7 ++++---
 .github/workflows/test.yml | 5 +++--
 .pre-commit-config.yaml    | 5 +++++
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d553e49..cd9d07e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2,19 +2,20 @@ name: Lint
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions: {}
+
 env:
   FORCE_COLOR: 1
   PIP_DISABLE_PIP_VERSION_CHECK: 1
 
-permissions:
-  contents: read
-
 jobs:
   lint:
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d74e607..6cd2336 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,8 +2,7 @@ name: Test
 
 on: [push, pull_request, workflow_dispatch]
 
-permissions:
-  contents: read
+permissions: {}
 
 env:
   FORCE_COLOR: 1
@@ -19,6 +18,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 60a928c..27a3996 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -28,6 +28,11 @@ repos:
     hooks:
       - id: actionlint
 
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.3.1
+    hooks:
+      - id: zizmor
+
   - repo: https://github.com/tox-dev/pyproject-fmt
     rev: v2.5.0
     hooks:

From 3c03238da4d39d5d74a281e9e528d2b50bdcefad Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Wed, 19 Feb 2025 13:35:05 +0200
Subject: [PATCH 2/2] Update pre-commit and apply Ruff changes

---
 .pre-commit-config.yaml | 12 ++++++------
 build_docs.py           |  5 ++---
 check_times.py          |  4 ++--
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 27a3996..44948ef 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -14,17 +14,17 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.7.1
+    rev: v0.9.6
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.29.4
+    rev: 0.31.1
     hooks:
       - id: check-github-workflows
 
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.3
+    rev: v1.7.7
     hooks:
       - id: actionlint
 
@@ -39,17 +39,17 @@ repos:
       - id: pyproject-fmt
 
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.22
+    rev: v0.23
     hooks:
       - id: validate-pyproject
 
   - repo: https://github.com/tox-dev/tox-ini-fmt
-    rev: 1.4.1
+    rev: 1.5.0
     hooks:
       - id: tox-ini-fmt
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: v3.3.3
+    rev: v3.5.1
     hooks:
       - id: prettier
         files: templates/switchers.js
diff --git a/build_docs.py b/build_docs.py
index 8b7f3f9..f7e3415 100755
--- a/build_docs.py
+++ b/build_docs.py
@@ -86,7 +86,7 @@ def __init__(self, name, *, status, branch_or_tag=None):
         if status not in self.STATUSES:
             raise ValueError(
                 "Version status expected to be one of: "
-                f"{', '.join(self.STATUSES|set(self.SYNONYMS.keys()))}, got {status!r}."
+                f"{', '.join(self.STATUSES | set(self.SYNONYMS.keys()))}, got {status!r}."
             )
         self.name = name
         self.branch_or_tag = branch_or_tag
@@ -732,8 +732,7 @@ def build(self):
                 shell=True,
             )
             subprocess.check_output(
-                "sed -i s/\N{REPLACEMENT CHARACTER}/?/g "
-                f"{self.checkout}/Doc/**/*.rst",
+                f"sed -i s/\N{REPLACEMENT CHARACTER}/?/g {self.checkout}/Doc/**/*.rst",
                 shell=True,
             )
 
diff --git a/check_times.py b/check_times.py
index 9310cd4..2b3d2f9 100644
--- a/check_times.py
+++ b/check_times.py
@@ -50,7 +50,7 @@ def calc_time(lines: list[str]) -> None:
             fmt_duration = format_seconds(state_data["last_build_duration"])
             reason = state_data["triggered_by"]
             print(
-                f"{start:%Y-%m-%d %H:%M UTC} | {version: <7} | {language: <8} | {fmt_duration :<14} | {reason}"
+                f"{start:%Y-%m-%d %H:%M UTC} | {version: <7} | {language: <8} | {fmt_duration:<14} | {reason}"
             )
 
         if line.endswith("Build start."):
@@ -64,7 +64,7 @@ def calc_time(lines: list[str]) -> None:
             timestamp = f"{line[:16]} UTC"
             _, fmt_duration = line.removesuffix(").").split("(")
             print(
-                f"{timestamp: <20} | --FULL- | -BUILD-- | {fmt_duration :<14} | -----------"
+                f"{timestamp: <20} | --FULL- | -BUILD-- | {fmt_duration:<14} | -----------"
             )
 
     if in_progress: