feat: Add zizmor

.github/workflows/build.yaml

@@ -10,6 +10,12 @@
   schedule:
     - cron: "0 19 * * SUN"
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   NODE_VERSION: "24"
   PACKAGE: "panel"
@@ -30,14 +36,14 @@
     name: Pixi lock
     runs-on: ubuntu-latest
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_lock@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-lock@v1
 
   conda_build:
     name: Build Conda
     needs: [pixi_lock]
     runs-on: "ubuntu-latest"
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_install@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-install@v1
         with:
           environments: "build"
           install: false
@@ -81,7 +87,7 @@
     needs: [pixi_lock]
     runs-on: "ubuntu-latest"
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_install@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-install@v1
         with:
           environments: "build"
           install: false
@@ -136,7 +142,7 @@
     needs: [pixi_lock]
     runs-on: "ubuntu-latest"
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_install@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-install@v1
         with:
           environments: "build"
           download-data: false
@@ -174,6 +180,7 @@
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
       - name: npm dev deploy
         if: contains(github.ref_name, 'a') || contains(github.ref_name, 'b') || contains(github.ref_name, 'rc')
         run: |
@@ -188,7 +195,7 @@
     needs: [pixi_lock]
     runs-on: "ubuntu-latest"
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_install@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-install@v1
         with:
           environments: "build"
           install: false
@@ -217,6 +224,7 @@
       - uses: actions/checkout@v6
         with:
           fetch-depth: "1"
+          persist-credentials: false
       - uses: actions/download-artifact@v8
         with:
           name: cdn
@@ -239,6 +247,8 @@
       TAG: ${{ github.ref_name }}
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*

.github/workflows/docs.yaml

@@ -25,6 +25,12 @@
   run:
     shell: bash -e {0}
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   DISPLAY: ":99.0"
 
@@ -33,15 +39,15 @@
     name: Pixi lock
     runs-on: ubuntu-latest
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_lock@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-lock@v1
 
   docs_build:
     name: Build Documentation
     needs: [pixi_lock]
     runs-on: "macos-latest"
     timeout-minutes: 180
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_install@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-install@v1
         with:
           environments: docs
           opengl: true

.github/workflows/downstream_tests.yaml

@@ -1,23 +1,28 @@
 name: downstream_tests
 
 on:
-  # Run this workflow after the build workflow has completed.
-  workflow_run:
+  workflow_run: # zizmor: ignore[dangerous-triggers]
     workflows: [packages]
     types: [completed]
-  # Or by triggering it manually via Github's UI
   workflow_dispatch:
-    inputs:
-      manual:
-        description: don't change me!
-        type: boolean
-        required: true
-        default: true
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   downstream_tests:
-    uses: holoviz-dev/holoviz_tasks/.github/workflows/run_downstream_tests.yaml@main
-    with:
-      downstream_repos_as_json: "{\"downstream_repo\":[\"holoviews\", \"lumen\"]}"
-    secrets:
-      ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
+    name: Run downstream tests
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    strategy:
+      matrix:
+        downstream_repo: [holoviews, lumen]
+      fail-fast: false
+    steps:
+      - uses: holoviz-dev/holoviz_tasks/downstream-tests@v1
+        with:
+          downstream_repo: ${{ matrix.downstream_repo }}
+          github_token: ${{ secrets.ACCESS_TOKEN }}

.github/workflows/gallery.yaml

@@ -1,22 +1,28 @@
 name: gallery
 
 on:
-  workflow_run:
+  workflow_run: # zizmor: ignore[dangerous-triggers]
     workflows: [packages]
     types:
       - completed
   workflow_dispatch:
     inputs:
       target:
-        description: 'Build and deploy gallery'
+        description: "Build and deploy gallery"
         type: choice
         options:
-        - dev
-        - main
-        - dryrun
+          - dev
+          - main
+          - dryrun
         required: true
         default: dryrun
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   deploy_gallery:
     name: Gallery
@@ -29,14 +35,15 @@
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set and echo git ref
         id: vars
         env:
           HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
           echo "Deploying from ref $HEAD_BRANCH"
           echo "tag=$HEAD_BRANCH" >> $GITHUB_OUTPUT
-      - uses: conda-incubator/setup-miniconda@v3
+      - uses: conda-incubator/setup-miniconda@v4
         with:
           miniconda-version: "latest"
           auto-update-conda: true
@@ -60,12 +67,14 @@
             (github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'dev') ||
             (github.event_name == 'workflow_run' && (contains(steps.vars.outputs.tag, 'a') || contains(steps.vars.outputs.tag, 'b') || contains(steps.vars.outputs.tag, 'rc')))
           )
+        env:
+          TAG: ${{ steps.vars.outputs.tag || '0.0.1dev' }}
         run: |
           conda activate test
           ae5 login --hostname holoviz-demo.anaconda.com --username ${{ secrets.AE5_USERNAME }} --password ${{ secrets.AE5_PASSWORD }}
           ae5 deployment stop panel-gallery-dev --yes || :
           ae5 project delete panel-gallery-dev --yes || :
-          ae5 project upload examples/gallery --name panel-gallery-dev --tag ${{ steps.vars.outputs.tag || '0.0.1dev' }}
+          ae5 project upload examples/gallery --name panel-gallery-dev --tag "${TAG}"
           ae5 deployment start panel-gallery-dev --endpoint panel-gallery-dev --command dev --public --resource-profile large --wait
       - name: Upload and deploy prod gallery
         if: |
@@ -74,10 +83,12 @@
             (github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'main') ||
             (github.event_name == 'workflow_run' && !(contains(steps.vars.outputs.tag, 'a') || contains(steps.vars.outputs.tag, 'b') || contains(steps.vars.outputs.tag, 'rc')) && contains(steps.vars.outputs.tag, 'v'))
           )
+        env:
+          TAG: ${{ steps.vars.outputs.tag }}
         run: |
           conda activate test
           ae5 login --hostname holoviz-demo.anaconda.com --username ${{ secrets.AE5_USERNAME }} --password ${{ secrets.AE5_PASSWORD }}
           ae5 deployment stop panel-gallery --yes || :
           ae5 project delete panel-gallery --yes || :
-          ae5 project upload examples/gallery --name panel-gallery --tag ${{ steps.vars.outputs.tag }}
+          ae5 project upload examples/gallery --name panel-gallery --tag "${TAG}"
           ae5 deployment start panel-gallery --endpoint panel-gallery --command prod --public --resource-profile extra_large --wait

.github/workflows/jupyterlite.yaml

@@ -21,19 +21,25 @@
   schedule:
     - cron: "0 19 * * SUN"
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pixi_lock:
     name: Pixi lock
     runs-on: ubuntu-latest
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_lock@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-lock@v1
 
   lite_build:
     name: Build Jupyterlite
     needs: [pixi_lock]
     runs-on: "ubuntu-latest"
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_install@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-install@v1
         with:
           environments: "lite"
           install: false

.github/workflows/nightly_lock.yaml

@@ -4,6 +4,12 @@
   schedule:
     - cron: "0 0 * * *"
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   PACKAGE: "panel"
 
@@ -14,7 +20,7 @@
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: holoviz-dev/holoviz_tasks/pixi_lock@v0
+      - uses: holoviz-dev/holoviz_tasks/pixi-lock@v1
       - name: Upload lock-file to S3
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}