ci: apply some zizmor suggestions

.github/workflows/docs-pages.yml

@@ -15,16 +15,20 @@ jobs:
       contents: read
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.13"
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        with:
+          enable-cache: false
       - run: touch src/fava/static/app.js
       - run: make docs
       - if: github.repository == 'beancount/fava'
-        uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v4
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: "build/docs"
   deploy:
@@ -42,4 +46,4 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/publish.yml

@@ -18,19 +18,21 @@ jobs:
   build-and-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+          persist-credentials: false
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.13"
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: "lts/*"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
+          package-manager-cache: false
       - run: cd frontend && npm ci
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        with:
+          enable-cache: false
       - run: uv build
       - name: Publish release
         if: github.event_name == 'push' && github.ref_type == 'tag'

.github/workflows/test.yml

@@ -31,11 +31,15 @@ jobs:
             make_target: "test-py"
             py: "3.14"
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: ${{ matrix.py }}
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        with:
+          enable-cache: false
       - run: touch src/fava/static/app.js
       - run: make ${{ matrix.make_target }}
   test-js:
@@ -48,39 +52,47 @@ jobs:
           - os: "ubuntu-latest"
             node: "current"
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: ${{ matrix.node }}
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
+          package-manager-cache: false
       - run: cd frontend && npm ci
       - run: cd frontend && npm run build
       - run: cd frontend && npm test
   lint-js:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.13"
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: "lts/*"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - uses: astral-sh/setup-uv@v7
+          package-manager-cache: false
+      - uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        with:
+          enable-cache: false
       - run: cd frontend && npm ci
       - run: uv run --no-dev --group pre-commit pre-commit run -a eslint
       - run: cd frontend; npx tsc
       - run: cd frontend; npx svelte-check
   lint-python:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.13"
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        with:
+          enable-cache: false
       - run: touch src/fava/static/app.js
       - run: make mypy

Makefile

@@ -89,7 +89,8 @@ update-precommit:
 # Update github actions action versions.
 .PHONY: update-github-actions
 update-github-actions:
-	cd frontend; npm run sync-github-actions
+	uvx gha-update
+	uvx zizmor .github/workflows/*.yml
 
 # Update frontend deps, Python deps and pre-commit
 .PHONY: update

frontend/package.json

@@ -7,7 +7,6 @@
     "build": "node build.ts",
     "dev": "node build.ts --watch",
     "sync-pre-commit": "node sync-pre-commit.ts",
-    "sync-github-actions": "node sync-github-actions.ts",
     "test": "node --conditions browser --import ./setup.mjs test.ts",
     "test:watch": "node --conditions browser --import ./setup.mjs test.ts --watch"
   },