🔒️ Add zizmor and fix audit findings

.github/dependabot.yml

@@ -5,12 +5,25 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆
  # Python
  - package-ecosystem: "uv"
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
+ commit-message:
+ prefix: ⬆
+ # pre-commit
+ - package-ecosystem: "pre-commit"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆

.github/workflows/add-to-project.yml

@@ -1,18 +1,21 @@
 name: Add to Project
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
  types:
  - opened
  - reopened
 
+permissions: {}
+
 jobs:
  add-to-project:
  name: Add to project
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
  with:
  project-url: https://github.com/orgs/fastapi/projects/2
- github-token: ${{ secrets.PROJECTS_TOKEN }}
+ github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/build-docs.yml

@@ -8,18 +8,23 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 jobs:
  changes:
  runs-on: ubuntu-latest
  # Required permissions
  permissions:
  pull-requests: read
+ timeout-minutes: 5
  # Set job outputs to values from filter step
  outputs:
  docs: ${{ steps.filter.outputs.docs }}
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  # For pull requests it's not necessary to checkout the code but for the main branch it is
+ with:
+ persist-credentials: false
  - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
  id: filter
  with:
@@ -41,19 +46,25 @@ jobs:
  - changes
  if: ${{ needs.changes.outputs.docs == 'true' }}
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  enable-cache: true
  cache-dependency-glob: |
  pyproject.toml
@@ -78,6 +89,7 @@ jobs:
  needs:
  - build-docs
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Decide whether the needed jobs succeeded or failed
  uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2

.github/workflows/deploy-docs.yml

@@ -1,37 +1,41 @@
 name: Deploy Docs
 on:
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
  workflows:
  - Build Docs
  types:
  - completed
 
-permissions:
- deployments: write
- issues: write
- pull-requests: write
- statuses: write
+permissions: {}
 
 jobs:
  deploy-docs:
  runs-on: ubuntu-latest
+ permissions:
+ deployments: write
+ issues: write
+ pull-requests: write
+ statuses: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
-enable-cache: true
-cache-dependency-glob: |
- pyproject.toml
- uv.lock
+# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+version: "0.11.4"
+enable-cache: false
  - name: Install GitHub Actions dependencies
  run: uv sync --locked --no-dev --group github-actions
  - name: Deploy Docs Status Pending
@@ -61,8 +65,8 @@ jobs:
  BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
  uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
  with:
- apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+ accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
  command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
  - name: Deploy Docs Status Error
  if: failure()

.github/workflows/detect-conflicts.yml

@@ -1,15 +1,18 @@
 name: "Conflict detector"
 on:
  push:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types: [synchronize]
 
+permissions: {}
+
 jobs:
  main:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Check if PRs have merge conflicts
  uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

.github/workflows/issue-manager.yml

@@ -9,19 +9,21 @@ on:
  issues:
  types:
  - labeled
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - labeled
  workflow_dispatch:
 
-permissions:
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
  issue-manager:
  if: github.repository_owner == 'fastapi'
  runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: Labels
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - opened
  - synchronize
@@ -9,12 +9,15 @@ on:
  - labeled
  - unlabeled
 
+permissions: {}
+
 jobs:
  labeler:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
  if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
  permissions:
  pull-requests: read
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
  with:

.github/workflows/latest-changes.yml

@@ -1,7 +1,7 @@
 name: Latest Changes
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  branches:
  - main
  types:
@@ -16,14 +16,19 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  latest-changes:
  runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  with:
  # To allow latest-changes to commit to the main branch
- token: ${{ secrets.SQLMODEL_LATEST_CHANGES }}
+ token: ${{ secrets.SQLMODEL_LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # required by tiangolo/latest-changes
  # Allow debugging with tmate
  - name: Setup tmate session
  uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

.github/workflows/pre-commit.yml

@@ -6,13 +6,16 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 env:
  # Forks and Dependabot don't have access to secrets
  HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
 
 jobs:
  pre-commit:
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
@@ -28,7 +31,8 @@ jobs:
  # And it needs the full history to be able to compute diffs
  fetch-depth: 0
  # A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
- token: ${{ secrets.PRE_COMMIT }}
+ token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # Required for `git push` command
  # pre-commit lite ci needs the default checkout configs to work
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
  # To be able to commit it needs the head branch of the PR, the remote one
  ref: ${{ github.event.pull_request.head.sha }}
  fetch-depth: 0
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  cache-dependency-glob: |
  pyproject.toml
  uv.lock
  - name: Install Dependencies
  run: uv sync --locked
  - name: Run prek - pre-commit
  id: precommit
- run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
+ run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
  continue-on-error: true
  - name: Commit and push changes
  if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
  needs:
  - pre-commit
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/publish.yml

@@ -11,24 +11,33 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  publish:
  runs-on: ubuntu-latest
  permissions:
  id-token: write
  contents: read
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Install uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  - name: Build distribution
  run: uv build
  - name: Publish

.github/dependabot.yml

@@ -5,12 +5,25 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆
  # Python
  - package-ecosystem: "uv"
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
+ commit-message:
+ prefix: ⬆
+ # pre-commit
+ - package-ecosystem: "pre-commit"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆

.github/workflows/add-to-project.yml

@@ -1,18 +1,21 @@
 name: Add to Project
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
  types:
  - opened
  - reopened
 
+permissions: {}
+
 jobs:
  add-to-project:
  name: Add to project
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
  with:
  project-url: https://github.com/orgs/fastapi/projects/2
- github-token: ${{ secrets.PROJECTS_TOKEN }}
+ github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/build-docs.yml

@@ -8,18 +8,23 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 jobs:
  changes:
  runs-on: ubuntu-latest
  # Required permissions
  permissions:
  pull-requests: read
+ timeout-minutes: 5
  # Set job outputs to values from filter step
  outputs:
  docs: ${{ steps.filter.outputs.docs }}
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  # For pull requests it's not necessary to checkout the code but for the main branch it is
+ with:
+ persist-credentials: false
  - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
  id: filter
  with:
@@ -41,19 +46,25 @@ jobs:
  - changes
  if: ${{ needs.changes.outputs.docs == 'true' }}
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  enable-cache: true
  cache-dependency-glob: |
  pyproject.toml
@@ -78,6 +89,7 @@ jobs:
  needs:
  - build-docs
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Decide whether the needed jobs succeeded or failed
  uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2

.github/workflows/deploy-docs.yml

@@ -1,37 +1,41 @@
 name: Deploy Docs
 on:
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
  workflows:
  - Build Docs
  types:
  - completed
 
-permissions:
- deployments: write
- issues: write
- pull-requests: write
- statuses: write
+permissions: {}
 
 jobs:
  deploy-docs:
  runs-on: ubuntu-latest
+ permissions:
+ deployments: write
+ issues: write
+ pull-requests: write
+ statuses: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
-enable-cache: true
-cache-dependency-glob: |
- pyproject.toml
- uv.lock
+# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+version: "0.11.4"
+enable-cache: false
  - name: Install GitHub Actions dependencies
  run: uv sync --locked --no-dev --group github-actions
  - name: Deploy Docs Status Pending
@@ -61,8 +65,8 @@ jobs:
  BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
  uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
  with:
- apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+ accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
  command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
  - name: Deploy Docs Status Error
  if: failure()

.github/workflows/detect-conflicts.yml

@@ -1,15 +1,18 @@
 name: "Conflict detector"
 on:
  push:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types: [synchronize]
 
+permissions: {}
+
 jobs:
  main:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Check if PRs have merge conflicts
  uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

.github/workflows/issue-manager.yml

@@ -9,19 +9,21 @@ on:
  issues:
  types:
  - labeled
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - labeled
  workflow_dispatch:
 
-permissions:
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
  issue-manager:
  if: github.repository_owner == 'fastapi'
  runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: Labels
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - opened
  - synchronize
@@ -9,12 +9,15 @@ on:
  - labeled
  - unlabeled
 
+permissions: {}
+
 jobs:
  labeler:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
  if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
  permissions:
  pull-requests: read
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
  with:

.github/workflows/latest-changes.yml

@@ -1,7 +1,7 @@
 name: Latest Changes
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  branches:
  - main
  types:
@@ -16,14 +16,19 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  latest-changes:
  runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  with:
  # To allow latest-changes to commit to the main branch
- token: ${{ secrets.SQLMODEL_LATEST_CHANGES }}
+ token: ${{ secrets.SQLMODEL_LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # required by tiangolo/latest-changes
  # Allow debugging with tmate
  - name: Setup tmate session
  uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

.github/workflows/pre-commit.yml

@@ -6,13 +6,16 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 env:
  # Forks and Dependabot don't have access to secrets
  HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
 
 jobs:
  pre-commit:
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
@@ -28,7 +31,8 @@ jobs:
  # And it needs the full history to be able to compute diffs
  fetch-depth: 0
  # A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
- token: ${{ secrets.PRE_COMMIT }}
+ token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # Required for `git push` command
  # pre-commit lite ci needs the default checkout configs to work
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
  # To be able to commit it needs the head branch of the PR, the remote one
  ref: ${{ github.event.pull_request.head.sha }}
  fetch-depth: 0
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  cache-dependency-glob: |
  pyproject.toml
  uv.lock
  - name: Install Dependencies
  run: uv sync --locked
  - name: Run prek - pre-commit
  id: precommit
- run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
+ run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
  continue-on-error: true
  - name: Commit and push changes
  if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
  needs:
  - pre-commit
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/publish.yml

@@ -11,24 +11,33 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  publish:
  runs-on: ubuntu-latest
  permissions:
  id-token: write
  contents: read
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Install uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  - name: Build distribution
  run: uv build
  - name: Publish

.github/dependabot.yml

@@ -5,12 +5,25 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆
  # Python
  - package-ecosystem: "uv"
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
+ commit-message:
+ prefix: ⬆
+ # pre-commit
+ - package-ecosystem: "pre-commit"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆

.github/workflows/add-to-project.yml

@@ -1,18 +1,21 @@
 name: Add to Project
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
  types:
  - opened
  - reopened
 
+permissions: {}
+
 jobs:
  add-to-project:
  name: Add to project
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
  with:
  project-url: https://github.com/orgs/fastapi/projects/2
- github-token: ${{ secrets.PROJECTS_TOKEN }}
+ github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/build-docs.yml

@@ -8,18 +8,23 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 jobs:
  changes:
  runs-on: ubuntu-latest
  # Required permissions
  permissions:
  pull-requests: read
+ timeout-minutes: 5
  # Set job outputs to values from filter step
  outputs:
  docs: ${{ steps.filter.outputs.docs }}
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  # For pull requests it's not necessary to checkout the code but for the main branch it is
+ with:
+ persist-credentials: false
  - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
  id: filter
  with:
@@ -41,19 +46,25 @@ jobs:
  - changes
  if: ${{ needs.changes.outputs.docs == 'true' }}
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  enable-cache: true
  cache-dependency-glob: |
  pyproject.toml
@@ -78,6 +89,7 @@ jobs:
  needs:
  - build-docs
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Decide whether the needed jobs succeeded or failed
  uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2

.github/workflows/deploy-docs.yml

@@ -1,37 +1,41 @@
 name: Deploy Docs
 on:
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
  workflows:
  - Build Docs
  types:
  - completed
 
-permissions:
- deployments: write
- issues: write
- pull-requests: write
- statuses: write
+permissions: {}
 
 jobs:
  deploy-docs:
  runs-on: ubuntu-latest
+ permissions:
+ deployments: write
+ issues: write
+ pull-requests: write
+ statuses: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
-enable-cache: true
-cache-dependency-glob: |
- pyproject.toml
- uv.lock
+# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+version: "0.11.4"
+enable-cache: false
  - name: Install GitHub Actions dependencies
  run: uv sync --locked --no-dev --group github-actions
  - name: Deploy Docs Status Pending
@@ -61,8 +65,8 @@ jobs:
  BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
  uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
  with:
- apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+ accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
  command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
  - name: Deploy Docs Status Error
  if: failure()

.github/workflows/detect-conflicts.yml

@@ -1,15 +1,18 @@
 name: "Conflict detector"
 on:
  push:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types: [synchronize]
 
+permissions: {}
+
 jobs:
  main:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Check if PRs have merge conflicts
  uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

.github/workflows/issue-manager.yml

@@ -9,19 +9,21 @@ on:
  issues:
  types:
  - labeled
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - labeled
  workflow_dispatch:
 
-permissions:
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
  issue-manager:
  if: github.repository_owner == 'fastapi'
  runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: Labels
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - opened
  - synchronize
@@ -9,12 +9,15 @@ on:
  - labeled
  - unlabeled
 
+permissions: {}
+
 jobs:
  labeler:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
  if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
  permissions:
  pull-requests: read
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
  with:

.github/workflows/latest-changes.yml

@@ -1,7 +1,7 @@
 name: Latest Changes
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  branches:
  - main
  types:
@@ -16,14 +16,19 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  latest-changes:
  runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  with:
  # To allow latest-changes to commit to the main branch
- token: ${{ secrets.SQLMODEL_LATEST_CHANGES }}
+ token: ${{ secrets.SQLMODEL_LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # required by tiangolo/latest-changes
  # Allow debugging with tmate
  - name: Setup tmate session
  uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

.github/workflows/pre-commit.yml

@@ -6,13 +6,16 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 env:
  # Forks and Dependabot don't have access to secrets
  HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
 
 jobs:
  pre-commit:
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
@@ -28,7 +31,8 @@ jobs:
  # And it needs the full history to be able to compute diffs
  fetch-depth: 0
  # A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
- token: ${{ secrets.PRE_COMMIT }}
+ token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # Required for `git push` command
  # pre-commit lite ci needs the default checkout configs to work
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
  # To be able to commit it needs the head branch of the PR, the remote one
  ref: ${{ github.event.pull_request.head.sha }}
  fetch-depth: 0
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  cache-dependency-glob: |
  pyproject.toml
  uv.lock
  - name: Install Dependencies
  run: uv sync --locked
  - name: Run prek - pre-commit
  id: precommit
- run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
+ run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
  continue-on-error: true
  - name: Commit and push changes
  if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
  needs:
  - pre-commit
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/publish.yml

@@ -11,24 +11,33 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  publish:
  runs-on: ubuntu-latest
  permissions:
  id-token: write
  contents: read
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Install uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  - name: Build distribution
  run: uv build
  - name: Publish

.github/dependabot.yml

@@ -5,12 +5,25 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆
  # Python
  - package-ecosystem: "uv"
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
+ commit-message:
+ prefix: ⬆
+ # pre-commit
+ - package-ecosystem: "pre-commit"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆

.github/workflows/add-to-project.yml

@@ -1,18 +1,21 @@
 name: Add to Project
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
  types:
  - opened
  - reopened
 
+permissions: {}
+
 jobs:
  add-to-project:
  name: Add to project
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
  with:
  project-url: https://github.com/orgs/fastapi/projects/2
- github-token: ${{ secrets.PROJECTS_TOKEN }}
+ github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/build-docs.yml

@@ -8,18 +8,23 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 jobs:
  changes:
  runs-on: ubuntu-latest
  # Required permissions
  permissions:
  pull-requests: read
+ timeout-minutes: 5
  # Set job outputs to values from filter step
  outputs:
  docs: ${{ steps.filter.outputs.docs }}
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  # For pull requests it's not necessary to checkout the code but for the main branch it is
+ with:
+ persist-credentials: false
  - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
  id: filter
  with:
@@ -41,19 +46,25 @@ jobs:
  - changes
  if: ${{ needs.changes.outputs.docs == 'true' }}
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  enable-cache: true
  cache-dependency-glob: |
  pyproject.toml
@@ -78,6 +89,7 @@ jobs:
  needs:
  - build-docs
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Decide whether the needed jobs succeeded or failed
  uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2

.github/workflows/deploy-docs.yml

@@ -1,37 +1,41 @@
 name: Deploy Docs
 on:
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
  workflows:
  - Build Docs
  types:
  - completed
 
-permissions:
- deployments: write
- issues: write
- pull-requests: write
- statuses: write
+permissions: {}
 
 jobs:
  deploy-docs:
  runs-on: ubuntu-latest
+ permissions:
+ deployments: write
+ issues: write
+ pull-requests: write
+ statuses: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
-enable-cache: true
-cache-dependency-glob: |
- pyproject.toml
- uv.lock
+# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+version: "0.11.4"
+enable-cache: false
  - name: Install GitHub Actions dependencies
  run: uv sync --locked --no-dev --group github-actions
  - name: Deploy Docs Status Pending
@@ -61,8 +65,8 @@ jobs:
  BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
  uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
  with:
- apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+ accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
  command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
  - name: Deploy Docs Status Error
  if: failure()

.github/workflows/detect-conflicts.yml

@@ -1,15 +1,18 @@
 name: "Conflict detector"
 on:
  push:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types: [synchronize]
 
+permissions: {}
+
 jobs:
  main:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Check if PRs have merge conflicts
  uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

.github/workflows/issue-manager.yml

@@ -9,19 +9,21 @@ on:
  issues:
  types:
  - labeled
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - labeled
  workflow_dispatch:
 
-permissions:
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
  issue-manager:
  if: github.repository_owner == 'fastapi'
  runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: Labels
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - opened
  - synchronize
@@ -9,12 +9,15 @@ on:
  - labeled
  - unlabeled
 
+permissions: {}
+
 jobs:
  labeler:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
  if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
  permissions:
  pull-requests: read
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
  with:

.github/workflows/latest-changes.yml

@@ -1,7 +1,7 @@
 name: Latest Changes
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  branches:
  - main
  types:
@@ -16,14 +16,19 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  latest-changes:
  runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  with:
  # To allow latest-changes to commit to the main branch
- token: ${{ secrets.SQLMODEL_LATEST_CHANGES }}
+ token: ${{ secrets.SQLMODEL_LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # required by tiangolo/latest-changes
  # Allow debugging with tmate
  - name: Setup tmate session
  uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

.github/workflows/pre-commit.yml

@@ -6,13 +6,16 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 env:
  # Forks and Dependabot don't have access to secrets
  HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
 
 jobs:
  pre-commit:
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
@@ -28,7 +31,8 @@ jobs:
  # And it needs the full history to be able to compute diffs
  fetch-depth: 0
  # A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
- token: ${{ secrets.PRE_COMMIT }}
+ token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # Required for `git push` command
  # pre-commit lite ci needs the default checkout configs to work
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
  # To be able to commit it needs the head branch of the PR, the remote one
  ref: ${{ github.event.pull_request.head.sha }}
  fetch-depth: 0
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  cache-dependency-glob: |
  pyproject.toml
  uv.lock
  - name: Install Dependencies
  run: uv sync --locked
  - name: Run prek - pre-commit
  id: precommit
- run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
+ run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
  continue-on-error: true
  - name: Commit and push changes
  if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
  needs:
  - pre-commit
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/publish.yml

@@ -11,24 +11,33 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  publish:
  runs-on: ubuntu-latest
  permissions:
  id-token: write
  contents: read
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Install uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  - name: Build distribution
  run: uv build
  - name: Publish

.github/dependabot.yml

@@ -5,12 +5,25 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆
  # Python
  - package-ecosystem: "uv"
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
+ commit-message:
+ prefix: ⬆
+ # pre-commit
+ - package-ecosystem: "pre-commit"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆

.github/workflows/add-to-project.yml

@@ -1,18 +1,21 @@
 name: Add to Project
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
  types:
  - opened
  - reopened
 
+permissions: {}
+
 jobs:
  add-to-project:
  name: Add to project
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
  with:
  project-url: https://github.com/orgs/fastapi/projects/2
- github-token: ${{ secrets.PROJECTS_TOKEN }}
+ github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/build-docs.yml

@@ -8,18 +8,23 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 jobs:
  changes:
  runs-on: ubuntu-latest
  # Required permissions
  permissions:
  pull-requests: read
+ timeout-minutes: 5
  # Set job outputs to values from filter step
  outputs:
  docs: ${{ steps.filter.outputs.docs }}
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  # For pull requests it's not necessary to checkout the code but for the main branch it is
+ with:
+ persist-credentials: false
  - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
  id: filter
  with:
@@ -41,19 +46,25 @@ jobs:
  - changes
  if: ${{ needs.changes.outputs.docs == 'true' }}
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  enable-cache: true
  cache-dependency-glob: |
  pyproject.toml
@@ -78,6 +89,7 @@ jobs:
  needs:
  - build-docs
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Decide whether the needed jobs succeeded or failed
  uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2

.github/workflows/deploy-docs.yml

@@ -1,37 +1,41 @@
 name: Deploy Docs
 on:
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
  workflows:
  - Build Docs
  types:
  - completed
 
-permissions:
- deployments: write
- issues: write
- pull-requests: write
- statuses: write
+permissions: {}
 
 jobs:
  deploy-docs:
  runs-on: ubuntu-latest
+ permissions:
+ deployments: write
+ issues: write
+ pull-requests: write
+ statuses: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
-enable-cache: true
-cache-dependency-glob: |
- pyproject.toml
- uv.lock
+# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+version: "0.11.4"
+enable-cache: false
  - name: Install GitHub Actions dependencies
  run: uv sync --locked --no-dev --group github-actions
  - name: Deploy Docs Status Pending
@@ -61,8 +65,8 @@ jobs:
  BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
  uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
  with:
- apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+ accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
  command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
  - name: Deploy Docs Status Error
  if: failure()

.github/workflows/detect-conflicts.yml

@@ -1,15 +1,18 @@
 name: "Conflict detector"
 on:
  push:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types: [synchronize]
 
+permissions: {}
+
 jobs:
  main:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Check if PRs have merge conflicts
  uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

.github/workflows/issue-manager.yml

@@ -9,19 +9,21 @@ on:
  issues:
  types:
  - labeled
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - labeled
  workflow_dispatch:
 
-permissions:
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
  issue-manager:
  if: github.repository_owner == 'fastapi'
  runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: Labels
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - opened
  - synchronize
@@ -9,12 +9,15 @@ on:
  - labeled
  - unlabeled
 
+permissions: {}
+
 jobs:
  labeler:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
  if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
  permissions:
  pull-requests: read
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
  with:

.github/workflows/latest-changes.yml

@@ -1,7 +1,7 @@
 name: Latest Changes
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  branches:
  - main
  types:
@@ -16,14 +16,19 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  latest-changes:
  runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  with:
  # To allow latest-changes to commit to the main branch
- token: ${{ secrets.SQLMODEL_LATEST_CHANGES }}
+ token: ${{ secrets.SQLMODEL_LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # required by tiangolo/latest-changes
  # Allow debugging with tmate
  - name: Setup tmate session
  uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

.github/workflows/pre-commit.yml

@@ -6,13 +6,16 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 env:
  # Forks and Dependabot don't have access to secrets
  HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
 
 jobs:
  pre-commit:
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
@@ -28,7 +31,8 @@ jobs:
  # And it needs the full history to be able to compute diffs
  fetch-depth: 0
  # A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
- token: ${{ secrets.PRE_COMMIT }}
+ token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # Required for `git push` command
  # pre-commit lite ci needs the default checkout configs to work
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
  # To be able to commit it needs the head branch of the PR, the remote one
  ref: ${{ github.event.pull_request.head.sha }}
  fetch-depth: 0
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  cache-dependency-glob: |
  pyproject.toml
  uv.lock
  - name: Install Dependencies
  run: uv sync --locked
  - name: Run prek - pre-commit
  id: precommit
- run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
+ run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
  continue-on-error: true
  - name: Commit and push changes
  if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
  needs:
  - pre-commit
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/publish.yml

@@ -11,24 +11,33 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  publish:
  runs-on: ubuntu-latest
  permissions:
  id-token: write
  contents: read
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Install uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  - name: Build distribution
  run: uv build
  - name: Publish

.github/dependabot.yml

@@ -5,12 +5,25 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆
  # Python
  - package-ecosystem: "uv"
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
+ commit-message:
+ prefix: ⬆
+ # pre-commit
+ - package-ecosystem: "pre-commit"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆

.github/workflows/add-to-project.yml

@@ -1,18 +1,21 @@
 name: Add to Project
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
  types:
  - opened
  - reopened
 
+permissions: {}
+
 jobs:
  add-to-project:
  name: Add to project
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
  with:
  project-url: https://github.com/orgs/fastapi/projects/2
- github-token: ${{ secrets.PROJECTS_TOKEN }}
+ github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/build-docs.yml

@@ -8,18 +8,23 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 jobs:
  changes:
  runs-on: ubuntu-latest
  # Required permissions
  permissions:
  pull-requests: read
+ timeout-minutes: 5
  # Set job outputs to values from filter step
  outputs:
  docs: ${{ steps.filter.outputs.docs }}
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  # For pull requests it's not necessary to checkout the code but for the main branch it is
+ with:
+ persist-credentials: false
  - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
  id: filter
  with:
@@ -41,19 +46,25 @@ jobs:
  - changes
  if: ${{ needs.changes.outputs.docs == 'true' }}
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  enable-cache: true
  cache-dependency-glob: |
  pyproject.toml
@@ -78,6 +89,7 @@ jobs:
  needs:
  - build-docs
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Decide whether the needed jobs succeeded or failed
  uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2

.github/workflows/deploy-docs.yml

@@ -1,37 +1,41 @@
 name: Deploy Docs
 on:
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
  workflows:
  - Build Docs
  types:
  - completed
 
-permissions:
- deployments: write
- issues: write
- pull-requests: write
- statuses: write
+permissions: {}
 
 jobs:
  deploy-docs:
  runs-on: ubuntu-latest
+ permissions:
+ deployments: write
+ issues: write
+ pull-requests: write
+ statuses: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
-enable-cache: true
-cache-dependency-glob: |
- pyproject.toml
- uv.lock
+# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+version: "0.11.4"
+enable-cache: false
  - name: Install GitHub Actions dependencies
  run: uv sync --locked --no-dev --group github-actions
  - name: Deploy Docs Status Pending
@@ -61,8 +65,8 @@ jobs:
  BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
  uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
  with:
- apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+ accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
  command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
  - name: Deploy Docs Status Error
  if: failure()

.github/workflows/detect-conflicts.yml

@@ -1,15 +1,18 @@
 name: "Conflict detector"
 on:
  push:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types: [synchronize]
 
+permissions: {}
+
 jobs:
  main:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Check if PRs have merge conflicts
  uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

.github/workflows/issue-manager.yml

@@ -9,19 +9,21 @@ on:
  issues:
  types:
  - labeled
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - labeled
  workflow_dispatch:
 
-permissions:
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
  issue-manager:
  if: github.repository_owner == 'fastapi'
  runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: Labels
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - opened
  - synchronize
@@ -9,12 +9,15 @@ on:
  - labeled
  - unlabeled
 
+permissions: {}
+
 jobs:
  labeler:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
  if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
  permissions:
  pull-requests: read
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
  with:

.github/workflows/latest-changes.yml

@@ -1,7 +1,7 @@
 name: Latest Changes
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  branches:
  - main
  types:
@@ -16,14 +16,19 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  latest-changes:
  runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  with:
  # To allow latest-changes to commit to the main branch
- token: ${{ secrets.SQLMODEL_LATEST_CHANGES }}
+ token: ${{ secrets.SQLMODEL_LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # required by tiangolo/latest-changes
  # Allow debugging with tmate
  - name: Setup tmate session
  uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

.github/workflows/pre-commit.yml

@@ -6,13 +6,16 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 env:
  # Forks and Dependabot don't have access to secrets
  HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
 
 jobs:
  pre-commit:
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
@@ -28,7 +31,8 @@ jobs:
  # And it needs the full history to be able to compute diffs
  fetch-depth: 0
  # A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
- token: ${{ secrets.PRE_COMMIT }}
+ token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # Required for `git push` command
  # pre-commit lite ci needs the default checkout configs to work
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
  # To be able to commit it needs the head branch of the PR, the remote one
  ref: ${{ github.event.pull_request.head.sha }}
  fetch-depth: 0
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  cache-dependency-glob: |
  pyproject.toml
  uv.lock
  - name: Install Dependencies
  run: uv sync --locked
  - name: Run prek - pre-commit
  id: precommit
- run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
+ run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
  continue-on-error: true
  - name: Commit and push changes
  if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
  needs:
  - pre-commit
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/publish.yml

@@ -11,24 +11,33 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  publish:
  runs-on: ubuntu-latest
  permissions:
  id-token: write
  contents: read
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Install uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  - name: Build distribution
  run: uv build
  - name: Publish

.github/dependabot.yml

@@ -5,12 +5,25 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆
  # Python
  - package-ecosystem: "uv"
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
+ commit-message:
+ prefix: ⬆
+ # pre-commit
+ - package-ecosystem: "pre-commit"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆

.github/workflows/add-to-project.yml

@@ -1,18 +1,21 @@
 name: Add to Project
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
  types:
  - opened
  - reopened
 
+permissions: {}
+
 jobs:
  add-to-project:
  name: Add to project
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
  with:
  project-url: https://github.com/orgs/fastapi/projects/2
- github-token: ${{ secrets.PROJECTS_TOKEN }}
+ github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/build-docs.yml

@@ -8,18 +8,23 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 jobs:
  changes:
  runs-on: ubuntu-latest
  # Required permissions
  permissions:
  pull-requests: read
+ timeout-minutes: 5
  # Set job outputs to values from filter step
  outputs:
  docs: ${{ steps.filter.outputs.docs }}
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  # For pull requests it's not necessary to checkout the code but for the main branch it is
+ with:
+ persist-credentials: false
  - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
  id: filter
  with:
@@ -41,19 +46,25 @@ jobs:
  - changes
  if: ${{ needs.changes.outputs.docs == 'true' }}
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  enable-cache: true
  cache-dependency-glob: |
  pyproject.toml
@@ -78,6 +89,7 @@ jobs:
  needs:
  - build-docs
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Decide whether the needed jobs succeeded or failed
  uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2

.github/workflows/deploy-docs.yml

@@ -1,37 +1,41 @@
 name: Deploy Docs
 on:
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
  workflows:
  - Build Docs
  types:
  - completed
 
-permissions:
- deployments: write
- issues: write
- pull-requests: write
- statuses: write
+permissions: {}
 
 jobs:
  deploy-docs:
  runs-on: ubuntu-latest
+ permissions:
+ deployments: write
+ issues: write
+ pull-requests: write
+ statuses: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
-enable-cache: true
-cache-dependency-glob: |
- pyproject.toml
- uv.lock
+# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+version: "0.11.4"
+enable-cache: false
  - name: Install GitHub Actions dependencies
  run: uv sync --locked --no-dev --group github-actions
  - name: Deploy Docs Status Pending
@@ -61,8 +65,8 @@ jobs:
  BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
  uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
  with:
- apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+ accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
  command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
  - name: Deploy Docs Status Error
  if: failure()

.github/workflows/detect-conflicts.yml

@@ -1,15 +1,18 @@
 name: "Conflict detector"
 on:
  push:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types: [synchronize]
 
+permissions: {}
+
 jobs:
  main:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Check if PRs have merge conflicts
  uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

.github/workflows/issue-manager.yml

@@ -9,19 +9,21 @@ on:
  issues:
  types:
  - labeled
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - labeled
  workflow_dispatch:
 
-permissions:
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
  issue-manager:
  if: github.repository_owner == 'fastapi'
  runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: Labels
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - opened
  - synchronize
@@ -9,12 +9,15 @@ on:
  - labeled
  - unlabeled
 
+permissions: {}
+
 jobs:
  labeler:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
  if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
  permissions:
  pull-requests: read
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
  with:

.github/workflows/latest-changes.yml

@@ -1,7 +1,7 @@
 name: Latest Changes
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  branches:
  - main
  types:
@@ -16,14 +16,19 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  latest-changes:
  runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  with:
  # To allow latest-changes to commit to the main branch
- token: ${{ secrets.SQLMODEL_LATEST_CHANGES }}
+ token: ${{ secrets.SQLMODEL_LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # required by tiangolo/latest-changes
  # Allow debugging with tmate
  - name: Setup tmate session
  uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

.github/workflows/pre-commit.yml

@@ -6,13 +6,16 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 env:
  # Forks and Dependabot don't have access to secrets
  HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
 
 jobs:
  pre-commit:
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
@@ -28,7 +31,8 @@ jobs:
  # And it needs the full history to be able to compute diffs
  fetch-depth: 0
  # A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
- token: ${{ secrets.PRE_COMMIT }}
+ token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # Required for `git push` command
  # pre-commit lite ci needs the default checkout configs to work
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
  # To be able to commit it needs the head branch of the PR, the remote one
  ref: ${{ github.event.pull_request.head.sha }}
  fetch-depth: 0
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  cache-dependency-glob: |
  pyproject.toml
  uv.lock
  - name: Install Dependencies
  run: uv sync --locked
  - name: Run prek - pre-commit
  id: precommit
- run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
+ run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
  continue-on-error: true
  - name: Commit and push changes
  if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
  needs:
  - pre-commit
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/publish.yml

@@ -11,24 +11,33 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  publish:
  runs-on: ubuntu-latest
  permissions:
  id-token: write
  contents: read
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Install uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  - name: Build distribution
  run: uv build
  - name: Publish

.github/dependabot.yml

@@ -5,12 +5,25 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆
  # Python
  - package-ecosystem: "uv"
  directory: "/"
  schedule:
  interval: "daily"
+ cooldown:
+ default-days: 7
+ commit-message:
+ prefix: ⬆
+ # pre-commit
+ - package-ecosystem: "pre-commit"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
  commit-message:
  prefix: ⬆

.github/workflows/add-to-project.yml

@@ -1,18 +1,21 @@
 name: Add to Project
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
  types:
  - opened
  - reopened
 
+permissions: {}
+
 jobs:
  add-to-project:
  name: Add to project
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
  with:
  project-url: https://github.com/orgs/fastapi/projects/2
- github-token: ${{ secrets.PROJECTS_TOKEN }}
+ github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/build-docs.yml

@@ -8,18 +8,23 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 jobs:
  changes:
  runs-on: ubuntu-latest
  # Required permissions
  permissions:
  pull-requests: read
+ timeout-minutes: 5
  # Set job outputs to values from filter step
  outputs:
  docs: ${{ steps.filter.outputs.docs }}
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  # For pull requests it's not necessary to checkout the code but for the main branch it is
+ with:
+ persist-credentials: false
  - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
  id: filter
  with:
@@ -41,19 +46,25 @@ jobs:
  - changes
  if: ${{ needs.changes.outputs.docs == 'true' }}
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  enable-cache: true
  cache-dependency-glob: |
  pyproject.toml
@@ -78,6 +89,7 @@ jobs:
  needs:
  - build-docs
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Decide whether the needed jobs succeeded or failed
  uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2

.github/workflows/deploy-docs.yml

@@ -1,37 +1,41 @@
 name: Deploy Docs
 on:
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
  workflows:
  - Build Docs
  types:
  - completed
 
-permissions:
- deployments: write
- issues: write
- pull-requests: write
- statuses: write
+permissions: {}
 
 jobs:
  deploy-docs:
  runs-on: ubuntu-latest
+ permissions:
+ deployments: write
+ issues: write
+ pull-requests: write
+ statuses: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
-enable-cache: true
-cache-dependency-glob: |
- pyproject.toml
- uv.lock
+# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+version: "0.11.4"
+enable-cache: false
  - name: Install GitHub Actions dependencies
  run: uv sync --locked --no-dev --group github-actions
  - name: Deploy Docs Status Pending
@@ -61,8 +65,8 @@ jobs:
  BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
  uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
  with:
- apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+ accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
  command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
  - name: Deploy Docs Status Error
  if: failure()

.github/workflows/detect-conflicts.yml

@@ -1,15 +1,18 @@
 name: "Conflict detector"
 on:
  push:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types: [synchronize]
 
+permissions: {}
+
 jobs:
  main:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Check if PRs have merge conflicts
  uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

.github/workflows/issue-manager.yml

@@ -9,19 +9,21 @@ on:
  issues:
  types:
  - labeled
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - labeled
  workflow_dispatch:
 
-permissions:
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
  issue-manager:
  if: github.repository_owner == 'fastapi'
  runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: Labels
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  types:
  - opened
  - synchronize
@@ -9,12 +9,15 @@ on:
  - labeled
  - unlabeled
 
+permissions: {}
+
 jobs:
  labeler:
  permissions:
  contents: read
  pull-requests: write
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
  if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
  permissions:
  pull-requests: read
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
  with:

.github/workflows/latest-changes.yml

@@ -1,7 +1,7 @@
 name: Latest Changes
 
 on:
- pull_request_target:
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
  branches:
  - main
  types:
@@ -16,14 +16,19 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  latest-changes:
  runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
  steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  with:
  # To allow latest-changes to commit to the main branch
- token: ${{ secrets.SQLMODEL_LATEST_CHANGES }}
+ token: ${{ secrets.SQLMODEL_LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # required by tiangolo/latest-changes
  # Allow debugging with tmate
  - name: Setup tmate session
  uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

.github/workflows/pre-commit.yml

@@ -6,13 +6,16 @@ on:
  - opened
  - synchronize
 
+permissions: {}
+
 env:
  # Forks and Dependabot don't have access to secrets
  HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
 
 jobs:
  pre-commit:
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
@@ -28,7 +31,8 @@ jobs:
  # And it needs the full history to be able to compute diffs
  fetch-depth: 0
  # A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
- token: ${{ secrets.PRE_COMMIT }}
+ token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
+ persist-credentials: true # Required for `git push` command
  # pre-commit lite ci needs the default checkout configs to work
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
  # To be able to commit it needs the head branch of the PR, the remote one
  ref: ${{ github.event.pull_request.head.sha }}
  fetch-depth: 0
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Setup uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  cache-dependency-glob: |
  pyproject.toml
  uv.lock
  - name: Install Dependencies
  run: uv sync --locked
  - name: Run prek - pre-commit
  id: precommit
- run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
+ run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
  continue-on-error: true
  - name: Commit and push changes
  if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
  needs:
  - pre-commit
  runs-on: ubuntu-latest
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:

.github/workflows/publish.yml

@@ -11,24 +11,33 @@ on:
  required: false
  default: 'false'
 
+permissions: {}
+
 jobs:
  publish:
  runs-on: ubuntu-latest
  permissions:
  id-token: write
  contents: read
+ timeout-minutes: 5
  steps:
  - name: Dump GitHub context
  env:
  GITHUB_CONTEXT: ${{ toJson(github) }}
  run: echo "$GITHUB_CONTEXT"
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
  - name: Set up Python
  uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
  python-version-file: ".python-version"
  - name: Install uv
  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
+ version: "0.11.4"
  - name: Build distribution
  run: uv build
  - name: Publish