chore(ci): address more zizmor violations

xmatthias · xmatthias · commit 5fcb81bb1fcf · 2026-01-21T07:11:18.000+01:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -164,7 +164,7 @@ jobs:
       name: pypi-test
       url: https://test.pypi.org/p/technical
     permissions:
-      id-token: write
+      id-token: write  # needed for pypi publish action
 
     steps:
 
@@ -190,7 +190,7 @@ jobs:
       name: pypi
       url: https://pypi.org/p/technical
     permissions:
-      id-token: write
+      id-token: write  # needed for pypi publish action
 
     steps:
 
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
@@ -11,6 +11,9 @@ on:
 # disable permissions for all of the available permissions
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build-docs:
@@ -21,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
diff --git a/.github/workflows/zizmor_action.yml b/.github/workflows/zizmor_action.yml
@@ -20,9 +20,9 @@ jobs:
     name: Run zizmor 🌈
     runs-on: ubuntu-latest
     permissions:
-      security-events: write
-      contents: read # only needed for private repos
-      actions: read # only needed for private repos
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      # contents: read         # Only needed for private repos. Needed to clone the repo.
+      # actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
     steps:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
