chore: modernize development and CI tooling

.github/workflows/ci.yml

@@ -13,15 +13,19 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   ci-scope:
     runs-on: ubuntu-latest
     outputs:
       ci_required: ${{ steps.scope.outputs.ci_required }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Detect CI scope
@@ -83,10 +87,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -95,7 +101,7 @@ jobs:
         run: uv python install 3.11
 
       - name: Cache uv-managed virtualenv
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: .venv
           key: venv-quality-${{ runner.os }}-py3.11-${{ hashFiles('uv.lock', 'pyproject.toml') }}
@@ -105,27 +111,24 @@ jobs:
       - name: Install dependencies
         run: uv sync --all-extras --dev
 
-      - name: Install Pre-Commit hooks
-        run: uv run pre-commit install
-
-      - name: Load cached Pre-Commit Dependencies
-        id: cached-pre-commit-dependencies
-        uses: actions/cache@v6
+      - name: Load cached Prek dependencies
+        id: cached-prek-dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
-          path: ~/.cache/pre-commit/
-          key: pre-commit|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
+          path: ~/.cache/prek/
+          key: prek|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
 
       # Each subsequent step uses `if: always()` so a failing earlier step
       # does not stop the others — a single failed run still reports every
       # tool's output, matching the parallel-jobs behavior of the old
       # validate/mypy/pyright/slotscheck split.
-      - name: Execute Pre-Commit
-        id: pre_commit
-        run: uv run pre-commit run --show-diff-on-failure --color=always --all-files
+      - name: Execute Prek
+        id: prek
+        run: uv run prek run --show-diff-on-failure --color=always --all-files
 
       - name: Run mypy
         id: mypy
-        if: always() && steps.pre_commit.conclusion != 'skipped' && steps.pre_commit.conclusion != 'cancelled'
+        if: always() && steps.prek.conclusion != 'skipped' && steps.prek.conclusion != 'cancelled'
         run: uv run mypy
 
       - name: Run pyright
@@ -134,9 +137,16 @@ jobs:
         run: uv run pyright
 
       - name: Run slotscheck
+        id: slotscheck
         if: always() && steps.pyright.conclusion != 'skipped' && steps.pyright.conclusion != 'cancelled'
         run: uv run slotscheck sqlspec
 
+      - name: Audit GitHub Actions workflows
+        if: always() && steps.slotscheck.conclusion != 'skipped' && steps.slotscheck.conclusion != 'cancelled'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: uv run zizmor --strict-collection .github/workflows
+
   # test-unit: fast tier — no Docker, runs tests/unit only.
   # Acts as a gate for test-integration: a broken unit test cancels the
   # entire matrix (fail-fast: true) AND prevents integration jobs from
@@ -157,10 +167,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -169,7 +181,7 @@ jobs:
         run: uv python install ${{ matrix.python-version }}
 
       - name: Cache uv-managed virtualenv
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: .venv
           key: venv-unit-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
@@ -194,7 +206,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: always()
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
         with:
           files: coverage-unit.xml
           flags: unit,py${{ matrix.python-version }}
@@ -212,10 +224,12 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -243,10 +257,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -255,7 +271,7 @@ jobs:
         run: uv python install ${{ matrix.python-version }}
 
       - name: Cache uv-managed virtualenv
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: .venv
           key: venv-integration-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
@@ -323,7 +339,7 @@ jobs:
 
       - name: Cache docker images
         id: docker-image-cache
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: /tmp/docker-images
           key: docker-images-v2-${{ hashFiles('.github/workflows/ci.yml') }}
@@ -387,7 +403,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: always() && steps.pytest.outcome != 'skipped'
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
         with:
           files: coverage-integration.xml
           flags: integration,py${{ matrix.python-version }}
@@ -478,10 +494,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock

.github/workflows/docs.yml

@@ -23,10 +23,12 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -41,7 +43,7 @@ jobs:
         run: uv run python tools/build_docs.py docs-build
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: docs-build
 
@@ -61,4 +63,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/pgo-validate.yml

@@ -3,16 +3,21 @@ name: PGO Validation
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   validate-pgo:
     name: Validate PGO three-stage build (Linux x86_64)
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 

.github/workflows/pr-title.yml

@@ -1,7 +1,7 @@
 name: "Lint PR Title"
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
@@ -15,6 +15,6 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}