From 6cf8d5df85abc1c27d6de5dbd69e398d2cffef31 Mon Sep 17 00:00:00 2001
From: konsti-openai <konsti@openai.com>
Date: Fri, 30 Oct 2026 23:40:13 +0000
Subject: [PATCH 1/2] Enforce zizmor checks for GitHub Actions

---
 .github/workflows/ci.yml | 9 +++++++++
 docs/development.md      | 1 +
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95eb299..fb5e56a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,8 @@ jobs:
     steps:
       - &checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - &setup-uv
         uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
@@ -102,3 +104,10 @@ jobs:
       - run: uv run --no-sync ty check
       - run: cargo fmt --check
       - run: cargo clippy --locked --all-targets -- -D warnings
+
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - *checkout
+      - *setup-uv
+      - run: uvx zizmor==1.31.1 --offline --strict-collection --collect=workflows,actions .
diff --git a/docs/development.md b/docs/development.md
index 219208c..ee02269 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -11,6 +11,7 @@ uv run --locked pytest
 uv run --locked ruff check .
 uv run --locked ruff format --check .
 uv run --locked --group benchmark ty check
+uvx zizmor==1.31.1 --offline --strict-collection --collect=workflows,actions .
 cargo fmt --check
 uv run --locked cargo clippy --locked --all-targets -- -D warnings
 ```

From 842291f0500955bfa7154df22086f9c63ccd0c70 Mon Sep 17 00:00:00 2001
From: konsti-openai <konsti@openai.com>
Date: Fri, 30 Oct 2026 23:41:44 +0000
Subject: [PATCH 2/2] Keep the zizmor job out of the project dependency cache

---
 .github/workflows/ci.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fb5e56a..5dd9375 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,9 +16,9 @@ jobs:
         with:
           persist-credentials: false
       - &setup-uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: &setup-uv-action astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
-          version: '0.12.23'
+          version: &uv-version '0.12.23'
       - uses: &setup-python-action actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14'
@@ -109,5 +109,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - *checkout
-      - *setup-uv
+      - uses: *setup-uv-action
+        with:
+          version: *uv-version
+          # Leave the shared uv cache to jobs that install project dependencies.
+          enable-cache: false
       - run: uvx zizmor==1.31.1 --offline --strict-collection --collect=workflows,actions .