CI: harden the workflows (zizmor) and add dependabot

.github/dependabot.yml

@@ -0,0 +1,38 @@
+# Keep the GitHub Actions we use and our Python requirements up to date.
+#
+# The cooldown periods keep us off freshly released versions for a while - if
+# an action or package gets yanked or hotfixed shortly after a release, we
+# never see it.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      # default-days also covers patch releases and actions not using semver.
+      default-days: 14
+      semver-minor-days: 30
+      semver-major-days: 90
+    groups:
+      actions:
+        patterns:
+          - "*"
+  - package-ecosystem: "pip"
+    directory: "/requirements.d"
+    ignore:
+    # black is also pinned in .github/workflows/black.yaml, which dependabot
+    # can not update - bumping only requirements.d/codestyle.txt would make the
+    # two disagree, so we do these bumps by hand.
+    - dependency-name: "black"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      # default-days also covers patch releases and packages not using semver.
+      default-days: 14
+      semver-minor-days: 30
+      semver-major-days: 90
+    groups:
+      pip-dependencies:
+        patterns:
+          - "*"

.github/workflows/black.yaml

@@ -5,14 +5,20 @@ name: Lint
 
 on: [push, pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
 jobs:
   lint:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7
-      - uses: psf/black@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e  # 26.5.1
         with:
             version: "~= 26.0"

.github/workflows/ci.yml

@@ -27,6 +27,10 @@ on:
     - 'requirements.d/*'
     - '!docs/**'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   ci_job:
 
@@ -70,10 +74,11 @@ jobs:
     continue-on-error: ${{ matrix.allow-failure || false }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         # just fetching 1 commit is not enough for setuptools-scm, so we fetch all
         fetch-depth: 0
+        persist-credentials: false
     - name: Install Linux packages
       if: runner.os == 'Linux'
       run: |
@@ -199,7 +204,7 @@ jobs:
         echo "BORGSTORE_TEST_REST1_URL=http://testuser:testpass@localhost/repos/repo1/" >> $GITHUB_ENV
         echo "BORGSTORE_TEST_REST2_URL=http://testuser:testpass@localhost/repos/repo2/" >> $GITHUB_ENV
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install Python requirements
@@ -216,7 +221,8 @@ jobs:
       if: runner.os == 'macOS'
       run: pip install -ve ".[rest,rclone,blake3]"
     - name: run tox envs
-      run: tox -e ${{ matrix.toxenv }}
+      # the toxenv comes from the job-level TOXENV env var, see above.
+      run: tox
     - name: Display diagnostics on failure
       if: failure() && runner.os == 'Linux'
       run: |

.github/workflows/release.yml

@@ -44,6 +44,7 @@ jobs:
         # Just fetching one commit is not enough for setuptools-scm, so we fetch all.
         fetch-depth: 0
         fetch-tags: true
+        persist-credentials: false
 
     - name: Set up Python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0