Add zizmor pre-commit hook

.github/workflows/nb_tests.yml

@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout branch
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false 
       - uses: actions/setup-python@v5
         with:
           python-version: '3.10' 

.github/workflows/publish.yml

@@ -19,6 +19,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
@@ -82,18 +84,22 @@ jobs:
     - name: Create GitHub Release
       env:
         GITHUB_TOKEN: ${{ github.token }}
+        REF_NAME: ${{ github.ref_name }}
+        REPOSITORY: ${{ github.repository }}
       run: >-
         gh release create
-        '${{ github.ref_name }}'
-        --repo '${{ github.repository }}'
+        '${REF_NAME}'
+        --repo '${REPOSITORY}'
         --generate-notes
     - name: Upload artifact signatures to GitHub Release
       env:
         GITHUB_TOKEN: ${{ github.token }}
+        REF_NAME: ${{ github.ref_name }}
+        REPOSITORY: ${{ github.repository }}
       run: >-
         gh release upload
-        '${{ github.ref_name }}' dist/**
-        --repo '${{ github.repository }}'
+        '${REF_NAME}' dist/**
+        --repo '${REPOSITORY}'
 
   build-for-prefix:
     name: Build prefix package
@@ -104,13 +110,17 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Download the built dist
         uses: actions/download-artifact@v4
         with:
           name: pip-dist
           path: dist/
       - name: Add tag to recipe
-        run: sed -i "s/TAG_VERSION/${{ github.ref_name }}/g" publish/recipes/release/ecoscope.yaml
+        env: 
+          REF_NAME: ${{ github.ref_name }}
+        run: sed -i "s/TAG_VERSION/${REF_NAME}/g" publish/recipes/release/ecoscope.yaml
       - name: Add dist to recipe
         run: sed -i "s/DIST_NAME/$(find ./dist/*.tar.gz  -printf "%f\n")/g" publish/recipes/release/ecoscope.yaml
       - name: Log the generated recipe

.github/workflows/tests.yml

@@ -22,6 +22,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+            persist-credentials: false
 
       - name: Setup Micromamba
         uses: mamba-org/[email protected]
@@ -40,8 +42,9 @@ jobs:
           ER_PASSWORD: ${{ secrets.ER_PASSWORD }}
           EE_ACCOUNT: ${{ secrets.EE_ACCOUNT }}
           EE_PRIVATE_KEY_DATA: ${{ secrets.EE_PRIVATE_KEY_DATA }}
+          INPUT_IO: ${{inputs.io}}
         run: |
-          pytest -v -r s -m "${{ inputs.io }}" --color=yes --cov=ecoscope --cov-append --cov-report=xml
+          pytest -v -r s -m "${INPUT_IO}" --color=yes --cov=ecoscope --cov-append --cov-report=xml
       
       - name: Codecov
         uses: codecov/codecov-action@v5

.pre-commit-config.yaml

@@ -38,4 +38,9 @@ repos:
         args: ['--ignore=E203,E402,W503', '--max-line-length=120']
           #- id: nbqa-isort
           #args: ['-m3', '--tc']
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.9.1 
+    hooks:
+      - id: zizmor
+
 exclude: ^ecoscope/contrib/