CI fixes, add zizmor workflow

.github/dependabot.yml

@@ -5,8 +5,12 @@ updates:
     # default location of `.github/workflows`
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci-clippy.yml

@@ -2,19 +2,24 @@ name: clippy (Linux)
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   build:
+    permissions: {}
 
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
-    - name: Run clippy
-      run: cargo clippy --all-features -- -D clippy::all
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Run clippy
+        run: cargo clippy --all-features -- -D clippy::all

.github/workflows/ci-fmt.yml

@@ -2,19 +2,24 @@ name: rustfmt (Linux)
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   build:
+    permissions: {}
 
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
-    - name: Run rustfmt
-      run: cargo fmt --check
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Run rustfmt
+        run: cargo fmt --check

.github/workflows/ci-linux.yml

@@ -2,50 +2,53 @@ name: Test (Linux)
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
-    - name: Test [no features]
-      run: cargo test --verbose
+      - name: Test [no features]
+        run: cargo test --verbose
 
-    - name: Test ['chrono' feature]
-      run: cargo test --verbose --features chrono
+      - name: Test ['chrono' feature]
+        run: cargo test --verbose --features chrono
 
-    - name: Test ['tokio' feature]
-      run: cargo test --verbose --features tokio
+      - name: Test ['tokio' feature]
+        run: cargo test --verbose --features tokio
 
-    - name: Test ['tokio-fs' feature]
-      run: cargo test --verbose --features tokio-fs
+      - name: Test ['tokio-fs' feature]
+        run: cargo test --verbose --features tokio-fs
 
-    - name: Test ['deflate' feature]
-      run: cargo test --verbose --features deflate
+      - name: Test ['deflate' feature]
+        run: cargo test --verbose --features deflate
 
-    - name: Test ['bzip2' feature]
-      run: cargo test --verbose --features bzip2
+      - name: Test ['bzip2' feature]
+        run: cargo test --verbose --features bzip2
 
-    - name: Test ['lzma' feature]
-      run: cargo test --verbose --features lzma
+      - name: Test ['lzma' feature]
+        run: cargo test --verbose --features lzma
 
-    - name: Test ['zstd' feature]
-      run: cargo test --verbose --features zstd
+      - name: Test ['zstd' feature]
+        run: cargo test --verbose --features zstd
 
-    - name: Test ['xz' feature]
-      run: cargo test --verbose --features xz
+      - name: Test ['xz' feature]
+        run: cargo test --verbose --features xz
 
-    - name: Test ['deflate64' feature]
-      run: cargo test --verbose --features deflate64
+      - name: Test ['deflate64' feature]
+        run: cargo test --verbose --features deflate64
 
-    - name: Test ['full' feature]
-      run: cargo test --verbose --features full
+      - name: Test ['full' feature]
+        run: cargo test --verbose --features full

.github/workflows/ci-typos.yml

@@ -2,23 +2,28 @@ name: typos (Linux)
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   build:
+    permissions: {}
 
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
-    - name: Install typos
-      run: cargo install typos-cli
+      - name: Install typos
+        run: cargo install typos-cli
 
-    - name: Run typos
-      run: typos --format brief
+      - name: Run typos
+        run: typos --format brief

.github/workflows/ci-wasm.yml

@@ -2,23 +2,28 @@ name: Build (WASM)
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   build:
+    permissions: {}
     name: Build ['full-wasm' feature] on ${{ matrix.target }}
     runs-on: ubuntu-latest
     strategy:
       matrix:
         target:
-          - wasm32-wasi
+          - wasm32-wasip1
           - wasm32-unknown-unknown
     steps:
-    - uses: actions/checkout@v4
-    - run: rustup target add ${{ matrix.target }}
-    - run: cargo build --verbose --target ${{ matrix.target }} --features full-wasm
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - run: rustup target add ${{ matrix.target }}
+      - run: cargo build --verbose --target ${{ matrix.target }} --features full-wasm

.github/workflows/zizmor.yml

@@ -0,0 +1,24 @@
+name: GitHub Actions Security Analysis with zizmor
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2