ci: Fix zizmor warnings and bump actions

.github/workflows/build.yaml

@@ -1,8 +1,6 @@
 ---
 name: Build and Test
-
-permissions:
-  contents: read
+permissions: {}
 
 on:
   push:
@@ -20,10 +18,9 @@ jobs:
     name: Unit Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
         uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
@@ -32,7 +29,7 @@ jobs:
           components: clippy
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Build
         run: cargo build --release
@@ -49,15 +46,14 @@ jobs:
     needs: [unit-tests]
     steps:
       - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: musl-tools
           version: ubuntu-latest
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
         uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
@@ -66,7 +62,7 @@ jobs:
           targets: x86_64-unknown-linux-musl
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: musl
 

.github/workflows/pr_prek.yaml

@@ -0,0 +1,29 @@
+---
+name: prek
+permissions: {}
+
+on:
+  pull_request:
+  merge_group:
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_TOOLCHAIN_VERSION: "1.97.1"
+
+jobs:
+  prek:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
+        with:
+          tool: cargo-deny
+
+      - uses: stackabletech/actions/run-prek@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
+        with:
+          rust: ${{ env.RUST_TOOLCHAIN_VERSION }}

.github/workflows/security_audit.yaml

@@ -1,24 +1,24 @@
 ---
 name: Daily Security Audit
+permissions: {}
 
 on:
   schedule:
     # Run every day at 04:15 UTC: https://crontab.guru/#15_4_*_*_*
     - cron: '15 4 * * *'
   workflow_dispatch:
 
-permissions:
-  contents: read
-  issues: write
-
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # Needed for rustsec/audit-check to publish a check run
+      issues: write # Needed for rustsec/audit-check to file an issue per advisory
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         # Build against stable because cargo-audit sometimes depends on things