ci: harden GitHub Actions security

.github/dependabot.yml

@@ -4,8 +4,10 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     groups:
-      actions:
+      github-actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7

.github/workflows/deploy.yml

@@ -6,12 +6,20 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Dispatch uses a dedicated PAT (secrets.MANIACLAB_AI_FACTORY_DEPLOY_TOKEN), not GITHUB_TOKEN
+permissions: {}
+
 jobs:
   trigger-gitops:
+    name: Trigger AI Factory GitOps
     runs-on: ubuntu-latest
     steps:
       - name: Send Repository Dispatch to maniaclab/ai_factory
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.MANIACLAB_AI_FACTORY_DEPLOY_TOKEN }}
           repository: maniaclab/ai_factory

.github/workflows/docs.yml

@@ -12,17 +12,21 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    name: Build docs
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # to checkout the repo
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - uses: prefix-dev/setup-pixi@v0.10.1
-        with:
-          pixi-version: v0.49.0
+      - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347 # v0.10.1
 
       - name: Check documentation
         run: pixi run build-check
@@ -32,11 +36,12 @@ jobs:
 
       - name: Upload static files as artifact
         id: deployment
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: site/
 
   deploy:
+    name: Deploy docs
     if:
       github.event_name == 'push' && github.ref == 'refs/heads/main' &&
       github.repository == 'usatlas/af-docs'
@@ -58,4 +63,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/semantic-pr-check.yml

@@ -1,6 +1,9 @@
 name: Semantic Pull Request
 
 on:
+  # zizmor: ignore[dangerous-triggers] no PR head is checked out and only the PR
+  # title is read via the GitHub API; pull_request_target is required so
+  # statuses: write works for PRs opened from forks.
   pull_request_target:
     types:
       - opened
@@ -24,6 +27,6 @@ jobs:
 
     steps:
       - name: Check PR title matches Conventional Commits spec
-        uses: amannn/action-semantic-pull-request@v6
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.pre-commit-config.yaml

@@ -7,13 +7,13 @@ exclude: ^(\.cruft\.json|\.copier-answers\.yml|pixi\.lock)$
 
 repos:
   - repo: https://github.com/adamchainz/blacken-docs
-    rev: "1.20.0"
+    rev: "fda77690955e9b63c6687d8806bafd56a526e45f" # frozen: 1.20.0
     hooks:
       - id: blacken-docs
         additional_dependencies: [black==26.*]
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: "v6.0.0"
+    rev: "3e8a8703264a2f4a69428a0aa4dcb512790b2c8c" # frozen: v6.0.0
     hooks:
       - id: check-added-large-files
       - id: check-case-conflict
@@ -29,35 +29,35 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/pre-commit/pygrep-hooks
-    rev: "v1.10.0"
+    rev: "3a6eb0fadf60b3cccfd80bad9dbb6fae7e47b316" # frozen: v1.10.0
     hooks:
       - id: rst-backticks
       - id: rst-directive-colons
       - id: rst-inline-touching-normal
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: "v3.9.6"
+    rev: "0ee178619d696787ca73d210cc191d720868c631" # frozen: v3.9.6
     hooks:
       - id: prettier
         types_or: [yaml, markdown, html, css, scss, javascript, json]
         args: [--prose-wrap=always]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.16.1"
+    rev: "39d9ac5938dadb73df0564a45f163e25ff9fa6e2" # frozen: v0.16.1
     hooks:
       - id: ruff-check
         args: ["--fix", "--show-fixes"]
       - id: ruff-format
 
   - repo: https://github.com/codespell-project/codespell
-    rev: "v2.4.3"
+    rev: "57b21406f092110c18776e39b0bda50d37c945c8" # frozen: v2.4.3
     hooks:
       - id: codespell
         exclude: ".+.ipynb"
         args: ["-w", "-L", "SLAC,checkin,slac,thq"]
 
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: "v0.11.0.1"
+    rev: "745eface02aef23e168a8afb6b5737818efbea95" # frozen: v0.11.0.1
     hooks:
       - id: shellcheck
 
@@ -70,14 +70,21 @@ repos:
         exclude: ^\.pre-commit-config\.yaml$
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: "0.37.4"
+    rev: "6b63472e72e1a91ed8a2f6d483790dfb644fa1d3" # frozen: 0.37.4
     hooks:
       - id: check-dependabot
       - id: check-github-workflows
       - id: check-readthedocs
 
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: 451b56af716f9f0d0c2b816503a3fd0cf8b036fa # frozen: v1.29.0
+    hooks:
+      - id: zizmor
+        files: "^\\.github"
+        args: [--persona=pedantic]
+
   - repo: https://github.com/rstcheck/rstcheck
-    rev: "v6.3.0"
+    rev: "d8774e96810795967ed9603f445b4e751e7b313f" # frozen: v6.3.0
     hooks:
       - id: rstcheck
         additional_dependencies: ["rstcheck[sphinx,toml]"]

docs/slac/jupyter_extra.md

@@ -75,8 +75,8 @@ After this and restart the Jupyter environment, you will see a new kernel call
 ## Using built-in Conda environments
 
 Some images, such as `atlas/20210403` has Andconda3 built-in to support Conda
-environments such as ["rapids-0.18"](https://rapids.ai/start.html) and
-"tf-keras-gpu". You can use these Conda environments by
+environments such as ["rapids-0.18"](https://rapids.ai) and "tf-keras-gpu". You
+can use these Conda environments by
 `source /opt/anaconda3/etc/profile.d/conda.sh`. Alternatively, you can also mix
 them with your own Conda installation and environments by creating a file
 `~/.condarc` and put the following lines inside