feat(ci): apply security fixes to all github workflows

.github/workflows/R-CMD-check.yaml

@@ -6,6 +6,12 @@ on:
 
 name: R-CMD-check
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   R-CMD-check:
     runs-on: ${{ matrix.config.os }}
@@ -24,13 +30,15 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Set up Rust stable
+        run: rustup toolchain install stable
 
       - name: Cache Rust Compilation
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: "microbiorust-r/src/rust -> target"
 
@@ -39,30 +47,31 @@ jobs:
         run: |
           # 1. Copy the sibling crate into the R package so it gets zipped into the tarball
           cp -r seqmetrics microbiorust-r/src/rust/seqmetrics
-          
+
           # 2. Rewrite the path in Cargo.toml to point to this new internal folder
           sed -i.bak 's|path *= *"[^"]*seqmetrics"|path = "./seqmetrics"|g' microbiorust-r/src/rust/Cargo.toml
-          
+
           # 3. Clean up the backup file sed creates
           rm microbiorust-r/src/rust/Cargo.toml.bak
       # --- THE FIX ENDS HERE ---
 
       - name: Set up R
-        uses: r-lib/actions/setup-r@v2
+        uses: r-lib/actions/setup-r@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2
         with:
           r-version: ${{ matrix.config.r }}
           use-public-rspm: true
 
       - name: Install R Dependencies
-        uses: r-lib/actions/setup-r-dependencies@v2
+        uses: r-lib/actions/setup-r-dependencies@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2
         with:
           working-directory: microbiorust-r
           extra-packages: any::rcmdcheck
           needs: check
 
       - name: Run R CMD Check
-        uses: r-lib/actions/check-r-package@v2
+        uses: r-lib/actions/check-r-package@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2
         with:
           working-directory: microbiorust-r
+          error-on: '"error"'
         env:
           _R_CHECK_CRAN_INCOMING_: false

.github/workflows/microbiorust-py_benchmarks.yml

@@ -5,43 +5,51 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  pages: write
-  id-token: write
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   benchmark:
     runs-on: ubuntu-latest
+    name: Run Benchmarks
+    permissions:
+      contents: write # needed for Github pages
+      pages: write # needed for Github pages
+      id-token: write # needed for Github pages
     env:
         CODECARBON_OFFLINE: "True"
         CODECARBON_COUNTRY_ISO_CODE: "USA"
         CODECARBON_CONSTANT_CARBON_INTENSITY: 475
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
           cache: 'pip'
 
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Set up Rust stable
+        run: rustup toolchain install stable
 
       - name: Install dependencies
         run: pip install asv virtualenv maturin biopython codecarbon
 
       # 1. GET OLD HISTORY
       - name: Load previous results
         continue-on-error: true
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: gh-pages
           path: old_pages
+          persist-credentials: false
       # set up ASV here so as to copy the history to it
       - name: Configure ASV
         working-directory: microbiorust-py
@@ -52,7 +60,7 @@ jobs:
           #there were difficulties with a subfolder being created sometimes
           ASV_ROOT_RESULTS_DIR="microbiorust-py/.asv/results/"
           ASV_MACHINE_RESULTS_DIR="microbiorust-py/.asv/results/github-runner/"
-          
+
           if [ -d "old_pages/results" ]; then
             echo "Restoring previous benchmark results from old_pages/results..."
             mkdir -p "${ASV_ROOT_RESULTS_DIR}"
@@ -91,7 +99,7 @@ jobs:
 
       # 6. UPLOAD EVERYTHING
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: microbiorust-py/.asv/html

.github/workflows/python-app.yml

@@ -6,7 +6,7 @@ name: microbiorust-py python tests
 on:
   push:
     branches: [ "main" ]
-    paths: 
+    paths:
       - 'microbiorust-py/**'
   pull_request:
     branches: [ "main" ]
@@ -16,37 +16,43 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-
+    name: Build and Test (Python)
     runs-on: ubuntu-latest
-    
+
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - name: Set up Python 3.12
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: "3.12"
         cache: 'pip'
         cache-dependency-path: 'microbiorust-py/pyproject.toml'
-    
-    - name: Set up Rust
-      uses: dtolnay/rust-toolchain@stable
-      
+
+    - name: Set up Rust stable
+      run: rustup toolchain install stable
+
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
         pip install maturin ruff pytest
         pip install ./microbiorust-py
-        
+
     - name: Lint with ruff
       run: |
         # stop the build for critical errors (E9, F63, F7, F82 equivalents)
         ruff check microbiorust-py/ --select E9,F63,F7,F82 --output-format=full
         # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
         ruff check microbiorust-py/ --exit-zero --line-length=127
-        
+
     - name: Test with pytest
       run: |
-        pytest -v 
+        pytest -v
       working-directory: microbiorust-py/tests

.github/workflows/release.yml

@@ -16,6 +16,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: Build wheels
@@ -35,20 +39,22 @@ jobs:
           - os: windows-latest
             target: x86_64
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           target: ${{ matrix.target }}
           args: --release --out dist --find-interpreter
-          sccache: 'true'
+          sccache: false
           manylinux: auto
           working-directory: microbiorust-py
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wheels-${{ matrix.os }}-${{ matrix.target }}
           path: microbiorust-py/dist
@@ -58,18 +64,20 @@ jobs:
     if: github.repository == 'microBioRust/microBioRust'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - name: Build sdist
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           command: sdist
           args: --out dist
           working-directory: microbiorust-py
       - name: Upload sdist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wheels-sdist
           path: microbiorust-py/dist
@@ -83,12 +91,12 @@ jobs:
     permissions:
       id-token: write  # from Trusted Publishing
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           merge-multiple: true
           path: dist
       - name: Publish to PyPI
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           command: upload
           args: --non-interactive --skip-existing dist/*

.github/workflows/rust.yml

@@ -9,14 +9,24 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-
+    name: Build and Test (Rust)
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+
     - name: Build
       run: cargo build
+
     - name: Run tests one-three
       run: cargo test --verbose

.github/workflows/zizmor.yml

@@ -0,0 +1,26 @@
+name: zizmor
+
+on:
+  pull_request:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-github-actions:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check Github Workflows for security issues
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          advanced-security: false