feat: update from template

.github/actions/setup_environment/action.yaml

@@ -34,13 +34,21 @@ inputs:
     description: "Trivy enabled"
     required: true
     default: "false"
+  zizmor-version:
+    description: "Zizmor version"
+    required: true
+    default: "1.0.1"
+  zizmor-enabled:
+    description: "Zizmor enabled"
+    required: true
+    default: "false"
 
 runs:
   using: "composite"
   steps:
     - name: Setup Task
       if: ${{ inputs.task-enabled == 'true' }}
-      uses: arduino/setup-task@v1
+      uses: arduino/setup-task@v2.0.0
       with:
         version: ${{ inputs.task-version }}
 
@@ -61,3 +69,12 @@ runs:
       uses: aquasecurity/[email protected]
       with:
         version: ${{ inputs.trivy-version }}
+
+    - name: Setup Zizmor
+      if: ${{ inputs.zizmor-enabled == 'true' }}
+      shell: bash
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install "zizmor==${ZIZMOR_VERSION}"
+      env:
+        ZIZMOR_VERSION: ${{ inputs.zizmor-version }}

.github/workflows/check-pr-title.yaml

@@ -8,6 +8,10 @@ on:
       - synchronize
       - edited
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number }}
+  cancel-in-progress: true
+
 jobs:
   check-pr-title:
     runs-on: ubuntu-latest
@@ -16,6 +20,7 @@ jobs:
       - name: Checkout config file
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           sparse-checkout: |
             commitlint.config.js
           sparse-checkout-cone-mode: false

.github/workflows/check-pr.yaml

@@ -7,6 +7,10 @@ on:
       - reopened
       - synchronize
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number }}
+  cancel-in-progress: true
+
 jobs:
   check-pr:
     runs-on: ubuntu-latest
@@ -17,12 +21,15 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Environment
         uses: ./.github/actions/setup_environment
         with:
           python-enabled: true
           poetry-enabled: true
+          zizmor-enabled: true
 
       - name: Install Dependencies
         run: |
@@ -31,6 +38,8 @@ jobs:
       - name: Lint PR
         run: |
           task lint
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Required for Zizmor
 
       - name: Test backend in container
         working-directory: backend

.github/workflows/github-watcher.yaml

@@ -19,6 +19,7 @@ jobs:
       - name: Checkout config file
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           sparse-checkout: |
             .github/github-watcher-config.yaml
           sparse-checkout-cone-mode: false

.github/workflows/release-pr-cleanup.yaml

@@ -5,6 +5,10 @@ on:
     - cron: 0 0 * * 0 # Every Sunday at 00:00 UTC
   workflow_dispatch:
 
+concurrency:
+  group: $${{ github.workflow }}
+  cancel-in-progress: false
+
 jobs:
   release-pr-cleanup:
     runs-on: ubuntu-22.04

.github/workflows/release-pr.yaml

@@ -7,6 +7,10 @@ on:
       - reopened
       - synchronize
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number }}
+  cancel-in-progress: true
+
 jobs:
   release-pr:
     runs-on: ubuntu-latest
@@ -19,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Environment
         uses: ./.github/actions/setup_environment
@@ -28,9 +34,11 @@ jobs:
       - name: Get Image Data
         id: get-image-data
         run: |
-          echo "registry=ghcr.io/${{ github.repository_owner }}" >> $GITHUB_OUTPUT
-          echo "name=${{ github.event.repository.name }}-beta" >> $GITHUB_OUTPUT
-          echo "tag=${{ github.event.number }}-${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
+          {
+            echo "registry=ghcr.io"
+            echo "name=${{ github.repository }}-beta"
+            echo "tag=${{ github.event.number }}-${{ github.run_id }}-${{ github.run_attempt }}"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3

.github/workflows/release-scan.yaml

@@ -6,6 +6,10 @@ on:
     - cron: 0 0 * * 0
   workflow_dispatch:
 
+concurrency:
+  group: $${{ github.workflow }}
+  cancel-in-progress: false
+
 jobs:
   scan:
     runs-on: ubuntu-latest
@@ -17,6 +21,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Environment
         uses: ./.github/actions/setup_environment

.github/workflows/release.yaml

@@ -5,6 +5,10 @@ on:
     types:
       - published
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
 jobs:
   release:
     runs-on: ubuntu-20.04
@@ -15,7 +19,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Environment
         uses: ./.github/actions/setup_environment