[pre-commit.ci] pre-commit autoupdate

[pre-commit-ci]

updates:

• github.com/astral-sh/ruff-pre-commit: v0.11.5 → v0.11.10
• github.com/woodruffw/zizmor-pre-commit: v1.5.2 → v1.7.0

[nicoddemus]

zizmor is failing with:

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/deploy.yml:34:7
   |
34 |       uses: hynek/build-and-inspect-python-package@v2.12.0
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

It wants us to update to hashes... however how does that affect dependabot updates?

[Pierre-Sassoulas]

I think it still works and start using a hash instead (you don't have to change to a hash each time). I don't remember on what repo I saw that though. Doing this even if dependabot doesn't work anymore would make sense considering that an action owner can delete and recreate tags and completely change the pipelines behavior without any reviews, which is a lot of trust to give to anyone.

[Pierre-Sassoulas]

Used the latest tag for softprops/action-gh-release@v2 and codecov/codecov-action@v5 which were implicitely the latest tag. We can expect to be spammed a lot more by dependabot, might be time to change the settings so it update less often.