From 596c49e6e4296cb8bdce6cc01e6c78d58b17264f Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Sun, 8 Dec 2024 15:47:44 +0200
Subject: [PATCH 1/9] Add zizmor to pre-commit

---
 .github/zizmor.yml      |  4 ++++
 .pre-commit-config.yaml | 10 ++++++++--
 2 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 00000000000000..4ae67ed204e54e
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,4 @@
+rules:
+  dangerous-triggers:
+    ignore:
+      - documentation-links.yml
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ccaf2390d99fae..68c929d7cef166 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.7.1
+    rev: v0.8.2
     hooks:
       - id: ruff
         name: Run Ruff (lint) on Doc/
@@ -51,7 +51,7 @@ repos:
         types_or: [c, inc, python, rst]
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.29.4
+    rev: 0.30.0
     hooks:
       - id: check-dependabot
       - id: check-github-workflows
@@ -61,6 +61,12 @@ repos:
     hooks:
       - id: actionlint
 
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.8.0
+    hooks:
+      - id: zizmor
+        args: [--min-severity=medium]
+
   - repo: https://github.com/sphinx-contrib/sphinx-lint
     rev: v1.0.0
     hooks:

From 7f5a8ecae5e8a1535a40623df732c3f7b77d3cf9 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Sun, 8 Dec 2024 15:49:21 +0200
Subject: [PATCH 2/9] Fix warning[artipacked]: credential persistence through
 GitHub Actions artifacts

---
 .github/workflows/build.yml                     | 9 +++++++++
 .github/workflows/jit.yml                       | 6 ++++++
 .github/workflows/lint.yml                      | 2 ++
 .github/workflows/mypy.yml                      | 2 ++
 .github/workflows/reusable-change-detection.yml | 2 ++
 .github/workflows/reusable-docs.yml             | 5 +++++
 .github/workflows/reusable-macos.yml            | 2 ++
 .github/workflows/reusable-tsan.yml             | 2 ++
 .github/workflows/reusable-ubuntu.yml           | 2 ++
 .github/workflows/reusable-wasi.yml             | 2 ++
 .github/workflows/reusable-windows-msi.yml      | 2 ++
 .github/workflows/reusable-windows.yml          | 2 ++
 .github/workflows/verify-ensurepip-wheels.yml   | 2 ++
 13 files changed, 40 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9b2f19fd6bcf54..4ed8608c0b6618 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,6 +58,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          persist-credentials: false
       - name: Runner image version
         run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
       - name: Check Autoconf and aclocal versions
@@ -94,6 +95,8 @@ jobs:
     if: needs.check_source.outputs.run_tests == 'true'
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.x'
@@ -268,6 +271,8 @@ jobs:
       LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}/lib
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Runner image version
       run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
     - name: Restore config.cache
@@ -328,6 +333,8 @@ jobs:
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Register gcc problem matcher
       run: echo "::add-matcher::.github/problem-matchers/gcc.json"
     - name: Install Dependencies
@@ -446,6 +453,8 @@ jobs:
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Runner image version
       run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
     - name: Restore config.cache
diff --git a/.github/workflows/jit.yml b/.github/workflows/jit.yml
index ee30cf5786d55b..9b84998a55666d 100644
--- a/.github/workflows/jit.yml
+++ b/.github/workflows/jit.yml
@@ -32,6 +32,8 @@ jobs:
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Build tier two interpreter
         run: |
           ./configure --enable-experimental-jit=interpreter --with-pydebug
@@ -85,6 +87,8 @@ jobs:
             runner: ${{ github.repository_owner == 'python' && 'ubuntu-24.04-aarch64' || 'ubuntu-24.04' }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'
@@ -138,6 +142,8 @@ jobs:
           - 19
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ccde03f91983df..d74ce8fcc256dc 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,6 +20,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index e5b05302b5ac27..5dfa8d7bcafd78 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -51,6 +51,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.13"
diff --git a/.github/workflows/reusable-change-detection.yml b/.github/workflows/reusable-change-detection.yml
index 1a6fd33186840c..964bd87e815f42 100644
--- a/.github/workflows/reusable-change-detection.yml
+++ b/.github/workflows/reusable-change-detection.yml
@@ -61,6 +61,8 @@ jobs:
     - run: >-
         echo '${{ github.event_name }}'
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Check for source changes
       id: check
       run: |
diff --git a/.github/workflows/reusable-docs.yml b/.github/workflows/reusable-docs.yml
index 39a97392e898aa..29ee4af3b6e7c0 100644
--- a/.github/workflows/reusable-docs.yml
+++ b/.github/workflows/reusable-docs.yml
@@ -28,6 +28,7 @@ jobs:
     - name: 'Check out latest PR branch commit'
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         ref: >-
           ${{
             github.event_name == 'pull_request'
@@ -81,6 +82,8 @@ jobs:
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: 'Set up Python'
       uses: actions/setup-python@v5
       with:
@@ -99,6 +102,8 @@ jobs:
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/cache@v4
       with:
         path: ~/.cache/pip
diff --git a/.github/workflows/reusable-macos.yml b/.github/workflows/reusable-macos.yml
index 4c3dd10194f8cb..36ae3e27207e37 100644
--- a/.github/workflows/reusable-macos.yml
+++ b/.github/workflows/reusable-macos.yml
@@ -29,6 +29,8 @@ jobs:
     runs-on: ${{ inputs.os }}
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Runner image version
       run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
     - name: Restore config.cache
diff --git a/.github/workflows/reusable-tsan.yml b/.github/workflows/reusable-tsan.yml
index 7a4d81f0bdcad1..b789260046398b 100644
--- a/.github/workflows/reusable-tsan.yml
+++ b/.github/workflows/reusable-tsan.yml
@@ -25,6 +25,8 @@ jobs:
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Runner image version
       run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
     - name: Restore config.cache
diff --git a/.github/workflows/reusable-ubuntu.yml b/.github/workflows/reusable-ubuntu.yml
index 2869202c7910c9..f658cc44bf44fd 100644
--- a/.github/workflows/reusable-ubuntu.yml
+++ b/.github/workflows/reusable-ubuntu.yml
@@ -28,6 +28,8 @@ jobs:
       TERM: linux
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Register gcc problem matcher
       run: echo "::add-matcher::.github/problem-matchers/gcc.json"
     - name: Install dependencies
diff --git a/.github/workflows/reusable-wasi.yml b/.github/workflows/reusable-wasi.yml
index 3f96c888e2dd30..07e80ab0bc40a4 100644
--- a/.github/workflows/reusable-wasi.yml
+++ b/.github/workflows/reusable-wasi.yml
@@ -20,6 +20,8 @@ jobs:
       CROSS_BUILD_WASI: cross-build/wasm32-wasip1
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     # No problem resolver registered as one doesn't currently exist for Clang.
     - name: "Install wasmtime"
       uses: bytecodealliance/actions/wasmtime/setup@v1
diff --git a/.github/workflows/reusable-windows-msi.yml b/.github/workflows/reusable-windows-msi.yml
index abdb1a1982fef8..0a7ba01f8630aa 100644
--- a/.github/workflows/reusable-windows-msi.yml
+++ b/.github/workflows/reusable-windows-msi.yml
@@ -20,5 +20,7 @@ jobs:
       IncludeFreethreaded: true
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Build CPython installer
       run: .\Tools\msi\build.bat --doc -${{ inputs.arch }}
diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml
index 12b68d68466d62..00a4caf2b89f5d 100644
--- a/.github/workflows/reusable-windows.yml
+++ b/.github/workflows/reusable-windows.yml
@@ -28,6 +28,8 @@ jobs:
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Register MSVC problem matcher
       if: inputs.arch != 'Win32'
       run: echo "::add-matcher::.github/problem-matchers/msvc.json"
diff --git a/.github/workflows/verify-ensurepip-wheels.yml b/.github/workflows/verify-ensurepip-wheels.yml
index 83b007f1c9c2ef..463e7bf3355cc3 100644
--- a/.github/workflows/verify-ensurepip-wheels.yml
+++ b/.github/workflows/verify-ensurepip-wheels.yml
@@ -26,6 +26,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3'

From 6b7f89f4e534e8914eb6ff3eb62c58058c8cf561 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Sun, 8 Dec 2024 15:49:57 +0200
Subject: [PATCH 3/9] Fix error[excessive-permissions]: overly broad workflow
 or job-level permissions

---
 .github/workflows/documentation-links.yml | 6 +++---
 .github/workflows/require-pr-label.yml    | 7 +++----
 .github/workflows/stale.yml               | 5 ++---
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/documentation-links.yml b/.github/workflows/documentation-links.yml
index 43a7afec73884e..fdb4b9aa29a7c8 100644
--- a/.github/workflows/documentation-links.yml
+++ b/.github/workflows/documentation-links.yml
@@ -10,9 +10,6 @@ on:
     - 'Doc/**'
     - '.github/workflows/doc.yml'
 
-permissions:
-  pull-requests: write
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -20,6 +17,9 @@ concurrency:
 jobs:
   documentation-links:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+
     steps:
       - uses: readthedocs/actions/preview@v1
         with:
diff --git a/.github/workflows/require-pr-label.yml b/.github/workflows/require-pr-label.yml
index bbedd22cc6d189..9a3e0d63e68bc6 100644
--- a/.github/workflows/require-pr-label.yml
+++ b/.github/workflows/require-pr-label.yml
@@ -4,15 +4,14 @@ on:
   pull_request:
     types: [opened, reopened, labeled, unlabeled, synchronize]
 
-permissions:
-  issues: write
-  pull-requests: write
-
 jobs:
   label-dnm:
     name: DO-NOT-MERGE
     if: github.repository_owner == 'python'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     timeout-minutes: 10
 
     steps:
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index f97587e68cbbe4..7578189f5d4d67 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -4,14 +4,13 @@ on:
   schedule:
   - cron: "0 */6 * * *"
 
-permissions:
-  pull-requests: write
-
 jobs:
   stale:
     if: github.repository_owner == 'python'
 
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     timeout-minutes: 10
 
     steps:

From b6115ca6a373f5753139713ec4da1d58fb8af847 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Sun, 8 Dec 2024 16:18:42 +0200
Subject: [PATCH 4/9] Fix error[template-injection]: code injection via
 template expansion

---
 .github/workflows/reusable-docs.yml        | 3 ++-
 .github/workflows/reusable-tsan.yml        | 7 +++++--
 .github/workflows/reusable-windows-msi.yml | 3 ++-
 .github/workflows/reusable-windows.yml     | 6 ++++--
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/reusable-docs.yml b/.github/workflows/reusable-docs.yml
index 29ee4af3b6e7c0..42b7965e46864c 100644
--- a/.github/workflows/reusable-docs.yml
+++ b/.github/workflows/reusable-docs.yml
@@ -22,6 +22,7 @@ jobs:
     env:
       branch_base: 'origin/${{ github.event.pull_request.base.ref }}'
       branch_pr: 'origin/${{ github.event.pull_request.head.ref }}'
+      commits: ${{ github.event.pull_request.commits }}
       refspec_base: '+${{ github.event.pull_request.base.sha }}:remotes/origin/${{ github.event.pull_request.base.ref }}'
       refspec_pr: '+${{ github.event.pull_request.head.sha }}:remotes/origin/${{ github.event.pull_request.head.ref }}'
     steps:
@@ -40,7 +41,7 @@ jobs:
       if: github.event_name == 'pull_request'
       run: |
         # Fetch enough history to find a common ancestor commit (aka merge-base):
-        git fetch origin ${{ env.refspec_pr }} --depth=$(( ${{ github.event.pull_request.commits }} + 1 )) \
+        git fetch origin ${{ env.refspec_pr }} --depth=$(( ${{ env.commits }} + 1 )) \
           --no-tags --prune --no-recurse-submodules
 
         # This should get the oldest commit in the local fetched history (which may not be the commit the PR branched from):
diff --git a/.github/workflows/reusable-tsan.yml b/.github/workflows/reusable-tsan.yml
index b789260046398b..b2cf1d389e4aed 100644
--- a/.github/workflows/reusable-tsan.yml
+++ b/.github/workflows/reusable-tsan.yml
@@ -23,6 +23,9 @@ jobs:
     name: 'Thread sanitizer'
     runs-on: ubuntu-24.04
     timeout-minutes: 60
+    env:
+      OPTIONS: ${{ inputs.options }}
+      SUPPRESSIONS_PATH: ${{ inputs.suppressions_path }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -49,7 +52,7 @@ jobs:
         sudo sysctl -w vm.mmap_rnd_bits=28
     - name: TSAN Option Setup
       run: |
-        echo "TSAN_OPTIONS=log_path=${GITHUB_WORKSPACE}/tsan_log suppressions=${GITHUB_WORKSPACE}/${{ inputs.suppressions_path }} handle_segv=0" >> "$GITHUB_ENV"
+        echo "TSAN_OPTIONS=log_path=${GITHUB_WORKSPACE}/tsan_log suppressions=${GITHUB_WORKSPACE}/${{ env.SUPPRESSIONS_PATH }} handle_segv=0" >> "$GITHUB_ENV"
         echo "CC=clang" >> "$GITHUB_ENV"
         echo "CXX=clang++" >> "$GITHUB_ENV"
     - name: Add ccache to PATH
@@ -61,7 +64,7 @@ jobs:
         save: ${{ github.event_name == 'push' }}
         max-size: "200M"
     - name: Configure CPython
-      run: ${{ inputs.options }}
+      run: ${{ env.OPTIONS }}
     - name: Build CPython
       run: make -j4
     - name: Display build info
diff --git a/.github/workflows/reusable-windows-msi.yml b/.github/workflows/reusable-windows-msi.yml
index 0a7ba01f8630aa..8a78c2d0d65d90 100644
--- a/.github/workflows/reusable-windows-msi.yml
+++ b/.github/workflows/reusable-windows-msi.yml
@@ -17,10 +17,11 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 60
     env:
+      ARCH: ${{ inputs.arch }}
       IncludeFreethreaded: true
     steps:
     - uses: actions/checkout@v4
       with:
         persist-credentials: false
     - name: Build CPython installer
-      run: .\Tools\msi\build.bat --doc -${{ inputs.arch }}
+      run: .\Tools\msi\build.bat --doc -${{ env.ARCH }}
diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml
index 00a4caf2b89f5d..348a5964386784 100644
--- a/.github/workflows/reusable-windows.yml
+++ b/.github/workflows/reusable-windows.yml
@@ -26,6 +26,8 @@ jobs:
     name: 'build and test (${{ inputs.arch }})'
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
+    env:
+      ARCH: ${{ inputs.arch }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -37,7 +39,7 @@ jobs:
       run: >-
         .\\PCbuild\\build.bat
         -e -d -v
-        -p ${{ inputs.arch }}
+        -p ${{ env.ARCH }}
         ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
     - name: Display build info  # FIXME(diegorusso): remove the `if`
       if: inputs.arch != 'arm64'
@@ -46,6 +48,6 @@ jobs:
       if: inputs.arch != 'arm64'
       run: >-
         .\\PCbuild\\rt.bat
-        -p ${{ inputs.arch }}
+        -p ${{ env.ARCH }}
         -d -q --fast-ci
         ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}

From 26c4d7d9e8f7d0f2ee95f06bc29fb7a69ab09b17 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Mon, 9 Dec 2024 16:24:14 +0200
Subject: [PATCH 5/9] Add permissions for the other job

---
 .github/workflows/require-pr-label.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/require-pr-label.yml b/.github/workflows/require-pr-label.yml
index 9a3e0d63e68bc6..0a6277c779ff67 100644
--- a/.github/workflows/require-pr-label.yml
+++ b/.github/workflows/require-pr-label.yml
@@ -27,6 +27,9 @@ jobs:
     name: Unresolved review
     if: github.repository_owner == 'python'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     timeout-minutes: 10
 
     steps:

From bd9e472c78768de9539d2a70d4756680ba2b8fb3 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Mon, 9 Dec 2024 16:24:34 +0200
Subject: [PATCH 6/9] Comment the zizmore config file

---
 .github/zizmor.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 4ae67ed204e54e..53675ee72444bb 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -1,3 +1,5 @@
+# Configuration for the zizmor static analysis tool, ran from pre-commit
+# https://woodruffw.github.io/zizmor/configuration/
 rules:
   dangerous-triggers:
     ignore:

From c33dcbaa7adda870cf5740ae4c9b3513fb8fecc4 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Mon, 9 Dec 2024 17:05:27 +0200
Subject: [PATCH 7/9] Fix help[template-injection]: code injection via template
 expansion

---
 .github/workflows/build.yml                |  2 +-
 .github/workflows/reusable-docs.yml        |  8 ++++----
 .github/workflows/reusable-tsan.yml        |  4 ++--
 .github/workflows/reusable-ubuntu.yml      |  2 +-
 .github/workflows/reusable-wasi.yml        | 10 +++++-----
 .github/workflows/reusable-windows-msi.yml |  2 +-
 .github/workflows/reusable-windows.yml     |  4 ++--
 .pre-commit-config.yaml                    |  1 -
 8 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4ed8608c0b6618..8787402ccc4423 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -418,7 +418,7 @@ jobs:
         #
         # (GH-104097) test_sysconfig is skipped because it has tests that are
         # failing when executed from inside a virtual environment.
-        ${{ env.VENV_PYTHON }} -m test \
+        "${VENV_PYTHON}" -m test \
           -W \
           -o \
           -j4 \
diff --git a/.github/workflows/reusable-docs.yml b/.github/workflows/reusable-docs.yml
index 42b7965e46864c..3962d12403919a 100644
--- a/.github/workflows/reusable-docs.yml
+++ b/.github/workflows/reusable-docs.yml
@@ -41,15 +41,15 @@ jobs:
       if: github.event_name == 'pull_request'
       run: |
         # Fetch enough history to find a common ancestor commit (aka merge-base):
-        git fetch origin ${{ env.refspec_pr }} --depth=$(( ${{ env.commits }} + 1 )) \
+        git fetch origin "${refspec_pr}" --depth=$(( commits + 1 )) \
           --no-tags --prune --no-recurse-submodules
 
         # This should get the oldest commit in the local fetched history (which may not be the commit the PR branched from):
-        COMMON_ANCESTOR=$( git rev-list --first-parent --max-parents=0 --max-count=1 ${{ env.branch_pr }} )
+        COMMON_ANCESTOR=$( git rev-list --first-parent --max-parents=0 --max-count=1 "${branch_pr}" )
         DATE=$( git log --date=iso8601 --format=%cd "${COMMON_ANCESTOR}" )
 
         # Get all commits since that commit date from the base branch (eg: master or main):
-        git fetch origin ${{ env.refspec_base }} --shallow-since="${DATE}" \
+        git fetch origin "${refspec_base}" --shallow-since="${DATE}" \
           --no-tags --prune --no-recurse-submodules
     - name: 'Set up Python'
       uses: actions/setup-python@v5
@@ -71,7 +71,7 @@ jobs:
       if: github.event_name == 'pull_request'
       run: |
         python Doc/tools/check-warnings.py \
-          --annotate-diff '${{ env.branch_base }}' '${{ env.branch_pr }}' \
+          --annotate-diff "${branch_base}" "${branch_pr}" \
           --fail-if-regression \
           --fail-if-improved \
           --fail-if-new-news-nit
diff --git a/.github/workflows/reusable-tsan.yml b/.github/workflows/reusable-tsan.yml
index b2cf1d389e4aed..b5144ca3e9efc4 100644
--- a/.github/workflows/reusable-tsan.yml
+++ b/.github/workflows/reusable-tsan.yml
@@ -52,7 +52,7 @@ jobs:
         sudo sysctl -w vm.mmap_rnd_bits=28
     - name: TSAN Option Setup
       run: |
-        echo "TSAN_OPTIONS=log_path=${GITHUB_WORKSPACE}/tsan_log suppressions=${GITHUB_WORKSPACE}/${{ env.SUPPRESSIONS_PATH }} handle_segv=0" >> "$GITHUB_ENV"
+        echo "TSAN_OPTIONS=log_path=${GITHUB_WORKSPACE}/tsan_log suppressions=${GITHUB_WORKSPACE}/${SUPPRESSIONS_PATH} handle_segv=0" >> "$GITHUB_ENV"
         echo "CC=clang" >> "$GITHUB_ENV"
         echo "CXX=clang++" >> "$GITHUB_ENV"
     - name: Add ccache to PATH
@@ -64,7 +64,7 @@ jobs:
         save: ${{ github.event_name == 'push' }}
         max-size: "200M"
     - name: Configure CPython
-      run: ${{ env.OPTIONS }}
+      run: "${OPTIONS}"
     - name: Build CPython
       run: make -j4
     - name: Display build info
diff --git a/.github/workflows/reusable-ubuntu.yml b/.github/workflows/reusable-ubuntu.yml
index f658cc44bf44fd..46c542940c8483 100644
--- a/.github/workflows/reusable-ubuntu.yml
+++ b/.github/workflows/reusable-ubuntu.yml
@@ -96,7 +96,7 @@ jobs:
       if: ${{ !inputs.free-threading }}
       run: >-
         python Tools/build/check_warnings.py
-        --compiler-output-file-path=${{ env.CPYTHON_BUILDDIR }}/compiler_output_ubuntu.txt
+        --compiler-output-file-path="${CPYTHON_BUILDDIR}/compiler_output_ubuntu.txt"
         --warning-ignore-file-path "${GITHUB_WORKSPACE}/Tools/build/.warningignore_ubuntu"
         --compiler-output-type=gcc
         --fail-on-regression
diff --git a/.github/workflows/reusable-wasi.yml b/.github/workflows/reusable-wasi.yml
index 07e80ab0bc40a4..4356d9c1c8795e 100644
--- a/.github/workflows/reusable-wasi.yml
+++ b/.github/workflows/reusable-wasi.yml
@@ -36,9 +36,9 @@ jobs:
     - name: "Install WASI SDK"  # Hard-coded to x64.
       if: steps.cache-wasi-sdk.outputs.cache-hit != 'true'
       run: |
-        mkdir ${{ env.WASI_SDK_PATH }} && \
-        curl -s -S --location https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${{ env.WASI_SDK_VERSION }}/wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-x86_64-linux.tar.gz | \
-        tar --strip-components 1 --directory ${{ env.WASI_SDK_PATH }} --extract --gunzip
+        mkdir "${WASI_SDK_PATH}" && \
+        curl -s -S --location "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_SDK_VERSION}/wasi-sdk-${WASI_SDK_VERSION}.0-x86_64-linux.tar.gz" | \
+        tar --strip-components 1 --directory "${WASI_SDK_PATH}" --extract --gunzip
     - name: "Configure ccache action"
       uses: hendrikmuhs/ccache-action@v1.2
       with:
@@ -74,6 +74,6 @@ jobs:
     - name: "Make host"
       run: python3 Tools/wasm/wasi.py make-host
     - name: "Display build info"
-      run: make --directory ${{ env.CROSS_BUILD_WASI }} pythoninfo
+      run: make --directory "${CROSS_BUILD_WASI}" pythoninfo
     - name: "Test"
-      run: make --directory ${{ env.CROSS_BUILD_WASI }} test
+      run: make --directory "${CROSS_BUILD_WASI}" test
diff --git a/.github/workflows/reusable-windows-msi.yml b/.github/workflows/reusable-windows-msi.yml
index 8a78c2d0d65d90..d0d53dba0b45d1 100644
--- a/.github/workflows/reusable-windows-msi.yml
+++ b/.github/workflows/reusable-windows-msi.yml
@@ -24,4 +24,4 @@ jobs:
       with:
         persist-credentials: false
     - name: Build CPython installer
-      run: .\Tools\msi\build.bat --doc -${{ env.ARCH }}
+      run: .\Tools\msi\build.bat --doc -"${ARCH}"
diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml
index 348a5964386784..f316ab5428bbc5 100644
--- a/.github/workflows/reusable-windows.yml
+++ b/.github/workflows/reusable-windows.yml
@@ -39,7 +39,7 @@ jobs:
       run: >-
         .\\PCbuild\\build.bat
         -e -d -v
-        -p ${{ env.ARCH }}
+        -p "${ARCH}"
         ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
     - name: Display build info  # FIXME(diegorusso): remove the `if`
       if: inputs.arch != 'arm64'
@@ -48,6 +48,6 @@ jobs:
       if: inputs.arch != 'arm64'
       run: >-
         .\\PCbuild\\rt.bat
-        -p ${{ env.ARCH }}
+        -p "${ARCH}"
         -d -q --fast-ci
         ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 68c929d7cef166..107f3b255735f4 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -65,7 +65,6 @@ repos:
     rev: v0.8.0
     hooks:
       - id: zizmor
-        args: [--min-severity=medium]
 
   - repo: https://github.com/sphinx-contrib/sphinx-lint
     rev: v1.0.0

From a2467909773f237d445143a3e467de5b0a0632c0 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Mon, 9 Dec 2024 18:18:13 +0200
Subject: [PATCH 8/9] Use bash for Windows so we can use ""

---
 .github/workflows/reusable-windows.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml
index f316ab5428bbc5..459d2b29e5d42b 100644
--- a/.github/workflows/reusable-windows.yml
+++ b/.github/workflows/reusable-windows.yml
@@ -41,6 +41,7 @@ jobs:
         -e -d -v
         -p "${ARCH}"
         ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
+      shell: bash
     - name: Display build info  # FIXME(diegorusso): remove the `if`
       if: inputs.arch != 'arm64'
       run: .\\python.bat -m test.pythoninfo
@@ -51,3 +52,4 @@ jobs:
         -p "${ARCH}"
         -d -q --fast-ci
         ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
+      shell: bash

From e5ba3d3ee976b02f094f00e85e07e37676649a79 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Mon, 9 Dec 2024 18:45:47 +0200
Subject: [PATCH 9/9] Improve wording

Co-authored-by: Alex Waygood <Alex.Waygood@Gmail.com>
---
 .github/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 53675ee72444bb..eeda8d9eaaf484 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -1,4 +1,4 @@
-# Configuration for the zizmor static analysis tool, ran from pre-commit
+# Configuration for the zizmor static analysis tool, run via pre-commit in CI
 # https://woodruffw.github.io/zizmor/configuration/
 rules:
   dangerous-triggers: