[woodruffw]

Hi there! This is an attempt to harden pyjwt's CI and Dependabot config a bit. All of the findings come from zizmor and I've broken each into its own commit.

As a TL;DR:

• Dependabot now enforces a 7d cooldown, making it harder for a compromised upstream dependency to impact pyjwt during a regular bump
• All actions/checkout calls use persist-credentials: false, which prevents them from dumping the GITHUB_TOKEN to disk (which is the default)
• All actions references are fully hash-pinned, removing a source of mutability (since tags/branches can be overwritten/mutated). Dependabot will also properly keep these updated, along with their comments 🙂
• Moved id-token: write to the smallest possible scope so that only the actual publishing job itself gets access to the OIDC token.
• Removed a minor template injection in stale.yml (this could have been a code execution avenue, although in practice the lack of a dangerous trigger means that the impact is not as severe).

All of the above and the changes themselves are 100% human written, and I'm happy to answer any questions about them! I didn't include a zizmor integration in this PR (since not every project wants that), but I'd be happy to add one as well if you're interested (as a way to backstop any future problems).

Signed-off-by: William Woodruff william@yossarian.net

[woodruffw]

(Also, thanks for your work on pyjwt! I've been a very happy user and occasional contributor over the years 🙂)