From 4a7ab06c00db3bb6193f57c69dda24b37406a6f8 Mon Sep 17 00:00:00 2001
From: Egor Tensin <egor@tensin.name>
Date: Tue, 20 Oct 2026 23:47:04 +0300
Subject: fix zizmor warnings

---
 .github/dependabot.yml            | 10 ++++++++++
 .github/workflows/ci.yml          |  8 ++++++++
 .github/workflows/maintenance.yml |  3 +++
 3 files changed, 21 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2bcf95d..3c868bb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,20 +5,28 @@ updates:
       - '**/*'
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: docker-compose
     directories:
       - '**/*'
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: gitsubmodule
     directories:
       - '**/*'
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: pip
     directory: /
     schedule:
@@ -27,3 +35,5 @@ updates:
       # The idea is that hopefully, it'll minimize the number of PRs I get for
       # minor dependencies in requirements.txt.
       cronjob: '30 04 * * 5'
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7d93ee1..34f6dbe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,8 @@ on:
       - '*.md'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -14,6 +16,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
@@ -43,6 +47,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
           submodules: recursive
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -63,6 +68,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           submodules: recursive
       - name: Integration test (Docker)
         run: sudo make test/docker
@@ -84,6 +90,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           submodules: recursive
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -176,6 +183,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
           submodules: recursive
       - name: Set up Python
         uses: actions/setup-python@v7
diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
index 07e2267..2dc3d71 100644
--- a/.github/workflows/maintenance.yml
+++ b/.github/workflows/maintenance.yml
@@ -7,6 +7,8 @@ on:
     - cron: '30 02 * * 5'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   maintenance:
     runs-on: ubuntu-latest
@@ -15,6 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           # I think that by default, pushes don't trigger other workflows, and
           # you need a separate token for that:
           # https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow#triggering-a-workflow-from-a-workflow
-- 
cgit v1.3