chore(deps): update pre-commit hook woodruffw/zizmor-pre-commit to v1…

….2.2 (#1039)

* chore(deps): update pre-commit hook woodruffw/zizmor-pre-commit to v1.2.2

* ci: set permissions explicitely

* chore: move zizmor config to `.github`

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Mathieu Kniewallner <mathieu.kniewallner@gmail.com>

.github/workflows/main.yml

@@ -15,6 +15,8 @@ env:
   # renovate: datasource=pypi depName=uv
   UV_VERSION: '0.5.24'
 
+permissions: {}
+
 jobs:
   quality:
     runs-on: ubuntu-24.04

.github/workflows/release.yml

@@ -10,6 +10,8 @@ env:
   # renovate: datasource=pypi depName=uv
   UV_VERSION: '0.5.24'
 
+permissions: {}
+
 jobs:
   set-version:
     runs-on: ubuntu-24.04

.github/workflows/validate-codecov-config.yml

@@ -8,6 +8,8 @@ on:
   push:
     branches: [main]
 
+permissions: {}
+
 jobs:
   validate-codecov-config:
     runs-on: ubuntu-24.04

.github/workflows/validate-renovate-config.yml

@@ -12,6 +12,8 @@ env:
   # renovate: datasource=node depName=node versioning=node
   NODE_VERSION: "22"
 
+permissions: {}
+
 jobs:
   validate-renovate-config:
     runs-on: ubuntu-24.04

zizmor.yml → .github/zizmor.yml

@@ -2,4 +2,4 @@ rules:
   artipacked:
     ignore:
       # Required for publishing documentation to `gh-pages` branch.
-      - release.yml:220
+      - release.yml:222

.pre-commit-config.yaml

@@ -53,6 +53,6 @@ repos:
         pass_filenames: false
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: "v1.1.1"
+    rev: "v1.2.2"
     hooks:
       - id: zizmor