ci: fix zizmor warnings (#1347)

Author: zsol

.github/workflows/build.yml

@@ -30,10 +30,8 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
-          cache: pip
-          cache-dependency-path: "pyproject.toml"
           python-version: "3.12"
-      - uses: dtolnay/rust-toolchain@stable # zizmor: ignore[unpinned-uses]
+      - uses: dtolnay/rust-toolchain@stable
       - name: Set MACOSX_DEPLOYMENT_TARGET for Intel MacOS
         if: matrix.os == 'macos-13'
         run: >-

.github/workflows/ci.yml

@@ -6,6 +6,8 @@ on:
       - main
   pull_request:
 
+permissions: {}
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}

.github/workflows/pypi_upload.yml

@@ -32,19 +32,18 @@ jobs:
           merge-multiple: true
       - uses: actions/setup-python@v5
         with:
-          cache: pip
-          cache-dependency-path: "pyproject.toml"
           python-version: "3.10"
       - name: Install hatch
         run: pip install -U hatch
       - name: Build a source tarball
         env:
           LIBCST_NO_LOCAL_SCHEME: 1
+          OUTDIR: ${{ steps.download.outputs.download-path }}
         run: >-
           hatch run python -m
           build
           --sdist
-          --outdir ${{ steps.download.outputs.download-path }}
+          --outdir "$OUTDIR"
       - name: Publish distribution 📦 to Test PyPI
         if: github.event_name == 'push'
         uses: pypa/gh-action-pypi-publish@release/v1

zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin