Add Zizmor pre-commit hook (#87)

It helps identify security issues in GitHub Actions workflows.

.github/workflows/checks.yml

@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Checkout the code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Poetry
         run: pipx install poetry
@@ -35,6 +37,8 @@ jobs:
     steps:
       - name: Checkout the code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -59,6 +63,8 @@ jobs:
     steps:
       - name: Checkout the code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Poetry
         run: pipx install poetry
@@ -81,6 +87,8 @@ jobs:
     steps:
       - name: Checkout the code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Poetry
         run: pipx install poetry

.github/workflows/release-to-pypi.yml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout the code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Poetry
         run: pipx install poetry

.pre-commit-config.yaml

@@ -7,3 +7,8 @@ repos:
         args:
           - --fix
       - id: ruff-format
+
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.8.0
+    hooks:
+      - id: zizmor