[GH-1977] Add zizmor with pre-commit (#2582)

Co-authored-by: Aashish Jha <aashishjha1107@gmail.com>

Author: jbampton

.github/linters/zizmor.yml

@@ -0,0 +1,29 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: any
+        astral-sh/setup-uv: any
+        docker/setup-qemu-action: any
+        github/*: any
+        pypa/cibuildwheel: any
+        r-lib/actions/check-r-package: any
+        r-lib/actions/setup-r: any
+        r-lib/actions/setup-r-dependencies: any

.github/workflows/codeql.yml

@@ -41,6 +41,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/docker-build.yml

@@ -60,6 +60,8 @@ jobs:
         shell: bash
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'

.github/workflows/docs.yml

@@ -26,6 +26,9 @@ on:
     branches:
       - '*'
 
+permissions:
+  contents: write
+
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
 
@@ -40,6 +43,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Java
         uses: actions/setup-java@v5
         with:

.github/workflows/example.yml

@@ -59,6 +59,8 @@ jobs:
             hadoop: 3.3.4
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'

.github/workflows/java.yml

@@ -86,6 +86,8 @@ jobs:
             skipTests: ''
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'

.github/workflows/labeler.yml

@@ -18,7 +18,7 @@
 # https://github.com/actions/labeler
 name: Pull Request Labeler
 on:
-  - pull_request_target
+  - pull_request_target # zizmor: ignore[dangerous-triggers]
 jobs:
   triage:
     permissions:

.github/workflows/pre-commit.yml

@@ -33,6 +33,8 @@ jobs:
     steps:
       - name: 'Checkout ${{ github.ref }} ( ${{ github.sha }} )'
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v6 # https://www.python.org/
         with:
           python-version: '3.10' # Version range or exact version of a Python version to use, using SemVer's version range syntax

.github/workflows/pyflink.yml

@@ -39,6 +39,9 @@ on:
       - 'python/**'
       - '.github/workflows/pyflink.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -51,6 +54,8 @@ jobs:
         python: ['3.11', '3.10']
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'

.github/workflows/python-extension.yml

@@ -59,6 +59,8 @@ jobs:
         working-directory: python
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}