ci: Resolve Zizmor static security audit findings in GitHub Actions workflows

.github/workflows/build.yml

@@ -7,23 +7,30 @@ on:
   pull_request:
     branches: [ master, 'r*' ]
 
+permissions:
+  contents: read
+
 env:
   USE_BAZEL_VERSION: 7.7.0
 
 jobs:
   build:
     name: Build (${{ matrix.os }}, Python ${{ matrix.python-version }})
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Set up conda environment
-      uses: conda-incubator/setup-miniconda@v3
+      uses: conda-incubator/setup-miniconda@505e6394dae86d6a5c7fbb6e3fb8938e3e863830 # v3.1.1
       with:
         auto-activate-base: false
         activate-environment: s2t-env
@@ -35,18 +42,23 @@ jobs:
       shell: bash -l {0}
       run: |
         # Install Bazelisk (manages Bazel versions)
+        mkdir -p "$HOME/.local/bin"
+        ARCH=$(uname -m)
+        if [ "$ARCH" == "x86_64" ]; then
+          ARCH="amd64"
+        fi
         if [ "$RUNNER_OS" == "Linux" ]; then
-          curl -Lo /tmp/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-amd64
+          curl -Lo "$HOME/.local/bin/bazel" "https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${ARCH}"
         elif [ "$RUNNER_OS" == "macOS" ]; then
-          ARCH=$(uname -m)
-          if [ "$ARCH" == "arm64" ]; then
-            curl -Lo /tmp/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-darwin-arm64
-          else
-            curl -Lo /tmp/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-darwin-amd64
-          fi
+          curl -Lo "$HOME/.local/bin/bazel" "https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-darwin-${ARCH}"
         fi
-        chmod +x /tmp/bazelisk
-        sudo mv /tmp/bazelisk /usr/local/bin/bazel
+        chmod +x "$HOME/.local/bin/bazel"
+        if [ -n "$CONDA_PREFIX" ]; then
+          cp "$HOME/.local/bin/bazel" "$CONDA_PREFIX/bin/bazel"
+        fi
+        echo "$HOME/.local/bin" >> $GITHUB_PATH
+        echo "USE_BAZEL_VERSION=7.7.0" >> $GITHUB_ENV
+        bazel --version
 
     - name: Configure Bazel
       shell: bash -l {0}
@@ -82,7 +94,7 @@ jobs:
         mv repaired_wheels/*.whl dist/
 
     - name: Upload Wheel Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
       with:
         name: wheels-${{ matrix.os }}-${{ matrix.python-version }}
         path: dist/*.whl
@@ -91,8 +103,12 @@ jobs:
     name: Build Docker Serving Image
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
     - name: Pre-pull Ubuntu base image from GCR mirror to prevent Docker Hub timeouts
       run: |
         docker pull mirror.gcr.io/library/ubuntu:22.04
@@ -107,16 +123,19 @@ jobs:
     needs: build
     if: github.event_name == 'push' && (startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/r'))
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Download all wheels
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         pattern: wheels-*
         path: dist/
         merge-multiple: true
 
     - name: Publish Package to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      # zizmor: ignore[use-trusted-publishing]
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
       with:
         password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: dist/

.github/workflows/pre-commit.yml

@@ -3,19 +3,25 @@ name: pre-commit
 on:
   pull_request:
   push:
-     branches: [master]
+    branches: [master]
+
+permissions:
+  contents: read
 
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         # Ensure the full history is fetched
         # This is required to run pre-commit on a specific set of commits
         # TODO: Remove this when all the pre-commit issues are fixed
         fetch-depth: 0
-    - uses: actions/setup-python@v5.1.1
+        persist-credentials: false
+    - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
-        python-version: 3.13
-    - uses: pre-commit/action@v3.0.1
+        python-version: "3.13"
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1