ci: harden GitHub Actions security

[kratsg]

Changes

• Pin all GitHub Actions in ci.yml, cd.yml, and docs.yml to commit SHAs with version comments (actions-up --min-age=7, then hand-pinned the one action actions-up skipped due to cooldown).
• Add persist-credentials: false to all actions/checkout steps (none of these jobs need to push).
• Add permissions: {} at the workflow level for ci.yml and cd.yml, with explicit least-privilege permissions: per job (all commented with why).
• Add explanatory comments to the existing pages/id-token permissions in docs.yml's deploy job.
• Replace direct matrix.pixi-environment interpolation in a run: step with an env var, to avoid template-injection risk.
• Add the zizmor pre-commit hook (pinned to a SHA) to catch these issues locally going forward.
• Freeze all existing pre-commit hook revs to commit SHAs.
• Add a 7-day cooldown to both dependabot.yml update groups and switch from weekly to monthly cadence.
• Add exclude-newer = "7d" to the pixi workspace so dependency resolution also respects the 7-day cooldown.

Major version changes

• None in this PR. The hynek/build-and-inspect-python-package v2 to v3.0.1 major bump and the actions/attest-build-provenance v4.1.1 to v4.2.2 bump were already merged into main via separate PRs before this branch was rebased; this PR only adds the SHA pin on top of those already-merged refs.

Held-back items

• None. Nothing broke unrelated code, so nothing needed to be frozen at an older version.

zizmor ignores

• None added. All findings (dependabot-cooldown, artipacked, excessive-permissions, undocumented-permissions, template-injection) were fixed directly rather than ignored.

Verification

• uvx zizmor --persona=pedantic .github reports no findings.
• uvx prek run -a passes all hooks, including zizmor.
• pixi info succeeds with the new exclude-newer setting.

[coderabbitai]

Warning

Review limit reached

@kratsg, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 93 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2f7426b0-14d0-4729-8a32-fe91bc603bad

📥 Commits

Reviewing files that changed from the base of the PR and between 55ec93a and ed0ab03.

📒 Files selected for processing (6)

• .github/dependabot.yml
• .github/workflows/cd.yml
• .github/workflows/ci.yml
• .github/workflows/docs.yml
• .pre-commit-config.yaml
• pixi.toml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}