Harden GitHub Actions and test on Python 3.15

.github/dependabot.yml

@@ -4,7 +4,11 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 3
   - package-ecosystem: uv
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 3

.github/workflows/pythonapp.yml

@@ -13,16 +13,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        persist-credentials: false
     - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
     - run: uv run ruff format --check .
     - run: uv run ruff check .
+    - name: Audit workflows (zizmor)
+      env:
+        GH_TOKEN: ${{ github.token }}  # enables online audits (known-vulnerable-actions, impostor-commit)
+      run: uv run zizmor --format=github .
 
   test:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', '3.15']
         markdown: ['locked']
         include:
           # Lowest supported Markdown (pyproject: Markdown>=3.2). Overrides the
@@ -33,6 +39,8 @@ jobs:
     name: test (py${{ matrix.python-version }}${{ matrix.markdown != 'locked' && format(', markdown {0}', matrix.markdown) || '' }})
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        persist-credentials: false
     - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       with:
         python-version: ${{ matrix.python-version }}

.github/workflows/pythonpublish.yml

@@ -15,6 +15,7 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0  # setuptools-scm derives the version from tags
+        persist-credentials: false
     - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
     - name: Test
       run: |

.github/zizmor.yml

@@ -0,0 +1,4 @@
+rules:
+  dependabot-cooldown:
+    config:
+      days: 3  # matches dependabot.yml (zizmor's default is 7)

CLAUDE.md

@@ -9,6 +9,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - Tests: `uv run pytest` (single test: `-k single_else`)
 - Lowest supported Markdown: `uv run --isolated --python 3.10 --with "markdown==3.2.*" pytest`
 - Lint/format (CI fails on either): `uv run ruff check .` and `uv run ruff format --check .`
+- Workflow audit (also in CI): `GH_TOKEN=$(gh auth token) uv run zizmor .`. Config in `.github/zizmor.yml` (its Dependabot cooldown must match `.github/dependabot.yml`).
 - Build: `uv build`. The version comes from the latest git tag via setuptools-scm; there is no version field to edit.
 
 ## Code

pyproject.toml

@@ -22,7 +22,11 @@ classifiers = [
 Homepage = "https://github.com/cssho/md-condition"
 
 [dependency-groups]
-dev = ["pytest>=8", "ruff>=0.14"]
+dev = [
+    "pytest>=8",
+    "ruff>=0.14",
+    "zizmor>=1.30.1",
+]
 
 [tool.setuptools]
 packages = ["md_condition"]