zizmor fixes (round 1) #14

	name: CI
	on: pull_request
	concurrency:
	group: ${{ github.workflow }}-${{ github.head_ref \|\| github.run_id }}
	cancel-in-progress: true
	jobs:
	matrix:
	name: Build test matrix
	runs-on: ubuntu-24.04
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	persist-credentials: false
	ref: ${{ github.event.pull_request.head.sha }}
	- name: Setup Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	cache: 'pip'
	cache-dependency-path: 'requirements/*.txt'
	- name: Run tox
	id: matrix
	run: \|
	pip install $(grep -E "^(tox\|tox-uv)==" requirements/local.txt)
	echo "tox_matrix=$(tox -l \| fgrep -v coverage \| python .github/matrix.py)" >> $GITHUB_OUTPUT
	outputs:
	tox_matrix: ${{ steps.matrix.outputs.tox_matrix }}

	test:
	name: Test -- ${{ matrix.tox_env }}
	runs-on: ubuntu-24.04
	needs: matrix
	strategy:
	matrix:
	include: ${{ fromJson(needs.matrix.outputs.tox_matrix) }}
	fail-fast: false
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	persist-credentials: false
	ref: ${{ github.event.pull_request.head.sha }}
	- name: Setup Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python }}
	cache: 'pip'
	cache-dependency-path: 'requirements/*.txt'
	- name: Run tests
	run: \|
	pip install $(grep -E "^(tox\|tox-uv)==" requirements/local.txt)
	tox -e ${{ matrix.tox_env }}

Provide feedback