Merge pull request #8638 from hugovk/pre-commit-zizmor

Add zizmor to pre-commit and fix potential cache-poisoning in wheels workflow

.github/workflows/wheels.yml

@@ -263,8 +263,6 @@ jobs:
       uses: actions/setup-python@v5
       with:
         python-version: "3.x"
-        cache: pip
-        cache-dependency-path: "Makefile"
 
     - run: make sdist
 

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.1
+    rev: v0.8.4
     hooks:
       - id: ruff
         args: [--exit-non-zero-on-fix]
@@ -24,7 +24,7 @@ repos:
         exclude: (Makefile$|\.bat$|\.cmake$|\.eps$|\.fits$|\.gd$|\.opt$)
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v19.1.4
+    rev: v19.1.5
     hooks:
       - id: clang-format
         types: [c]
@@ -56,6 +56,11 @@ repos:
       - id: check-readthedocs
       - id: check-renovate
 
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.10.0
+    hooks:
+      - id: zizmor
+
   - repo: https://github.com/sphinx-contrib/sphinx-lint
     rev: v1.0.0
     hooks: