From dc4418de2ecf2a83908469dd954fd2c7899ea97c Mon Sep 17 00:00:00 2001
From: Dan Shernicoff <dan@brassnet.biz>
Date: Wed, 28 Oct 2026 15:13:46 -0400
Subject: [PATCH 1/2] Add `zizmor` workflow

---
 .github/workflows/zizmor.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..9e6b86c
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,28 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Zizmor Check
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # required for advanced security policy
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4

From 0a3c41295671d343fd1d85be5b02d28311ce9964 Mon Sep 17 00:00:00 2001
From: Dan Shernicoff <dan@brassnet.biz>
Date: Wed, 28 Oct 2026 15:14:23 -0400
Subject: [PATCH 2/2] Update workflow pins

---
 .github/workflows/lint.yml                 | 4 ++--
 .github/workflows/profile_contributors.yml | 2 +-
 .github/workflows/publish.yml              | 4 ++--
 .github/workflows/test.yml                 | 4 ++--
 .github/workflows/zizmor.yml               | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 497db47..1830890 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,7 +16,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: "true"
       - name: Run Ruff
@@ -32,7 +32,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Markdown Lint base-files
-        uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
+        uses: DavidAnson/markdownlint-cli2-action@696eb3f2509270d7b882d2aa68347bc676e7af34 # v25.0.0
         with:
           globs: |
             *.md
diff --git a/.github/workflows/profile_contributors.yml b/.github/workflows/profile_contributors.yml
index fa95162..f3c14f1 100644
--- a/.github/workflows/profile_contributors.yml
+++ b/.github/workflows/profile_contributors.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Determine target login and issue number
         id: meta
         env:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 74d0625..b5d5104 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
+      - uses: hynek/build-and-inspect-python-package@67230f7b8410ae0052b39c1efc89d89fff43ff10 # v3.0.2
 
   publish-pypi:
     needs: build-and-inspect-package
@@ -38,4 +38,4 @@ jobs:
           path: dist
           name: Packages
       - name: Push to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e5a7bd5..6c3dcd5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: "true"
       - name: Run tests
@@ -44,7 +44,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: "true"
       - name: Set up env
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 9e6b86c..edc5aa9 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -25,4 +25,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0