ci: Resolve GitHub Actions security and fix Zizmor findings for TFT

.github/workflows/ci-lint.yml

@@ -3,19 +3,25 @@ name: pre-commit
 on:
   pull_request:
   push:
-     branches: [master]
+    branches: [master]
+
+permissions:
+  contents: read
 
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         # Ensure the full history is fetched
         # This is required to run pre-commit on a specific set of commits
         # TODO: Remove this when all the pre-commit issues are fixed
         fetch-depth: 0
-    - uses: actions/setup-python@v5.1.1
+        persist-credentials: false
+    - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
-        python-version: 3.13
-    - uses: pre-commit/action@v3.0.1
+        python-version: "3.13"
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/ci-test.yml

@@ -1,6 +1,7 @@
 # Github action definitions for unit-tests with PRs.
 
 name: tft-unit-tests
+
 on:
   pull_request:
     branches: [ master ]
@@ -9,23 +10,27 @@ on:
       - 'docs/**'
   workflow_dispatch:
 
-env:
-  USE_BAZEL_VERSION: 7.7.0
+permissions:
+  contents: read
 
 jobs:
   unit-tests:
     if: github.actor != 'copybara-service[bot]'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       matrix:
         python-version: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'

.github/workflows/docs.yml

@@ -1,52 +1,40 @@
-name: Deploy docs
+name: docs
+
 on:
-  workflow_dispatch:
   push:
     branches:
-      - 'master'
+      - master
   pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
 permissions:
-  contents: write
+  contents: read
+
 jobs:
-  deploy:
+  build:
+    name: Build docs
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-        if: (github.event_name != 'pull_request')
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - name: Set up Python 3.9
-        uses: actions/setup-python@v5
+      - name: Set up Python 3.12
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
-          python-version: '3.9'
+          python-version: '3.12'
           cache: 'pip'
           cache-dependency-path: |
             setup.py
             requirements-docs.txt
 
-      - name: Save time for cache for mkdocs
-        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-
-      - name: Caching
-        uses: actions/cache@v4
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-
       - name: Install Dependencies
         run: pip install -r requirements-docs.txt
 
-      - name: Deploy to GitHub Pages
-        run: mkdocs gh-deploy --force
-        if: (github.event_name != 'pull_request')
-
       - name: Build docs to check for errors
         run: mkdocs build
-        if: (github.event_name == 'pull_request')

.github/workflows/wheels.yml

@@ -6,19 +6,23 @@ on:
   release:
     types: [published]
 
-env:
-  USE_BAZEL_VERSION: 7.7.0
+permissions:
+  contents: read
 
 jobs:
   build-package:
     name: Build sdist
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Check out the repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Set up python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.10'
 
@@ -39,7 +43,7 @@ jobs:
         twine check wheelhouse/*
 
     - name: Upload artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
       with:
         name: sdist
         path: ./wheelhouse/*
@@ -53,10 +57,11 @@ jobs:
       name: pypi
       url: https://pypi.org/p/tensorflow-transform
     permissions:
+      contents: read
       id-token: write
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           merge-multiple: true
           path: wheels/
@@ -66,7 +71,8 @@ jobs:
           ls -lAs wheels/
 
       - name: Upload to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1.12
+        # zizmor: ignore[use-trusted-publishing]
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
           packages-dir: wheels/

mkdocs.yml

@@ -43,6 +43,9 @@ plugins:
   - autorefs
   - mkdocstrings:
       default_handler: python
+      inventories:
+        - https://docs.python.org/3/objects.inv
+        - https://beam.apache.org/releases/pydoc/current/objects.inv
       handlers:
         python:
           options:
@@ -74,11 +77,7 @@ plugins:
             extensions:
               - griffe_inherited_docstrings
             preload_modules:
-                - apache_beam
-          load_external_modules: true
-          inventories:
-            - https://docs.python.org/3/objects.inv
-            - https://beam.apache.org/releases/pydoc/current/objects.inv
+              - apache_beam
   - mkdocs-jupyter:
       ignore_h1_titles: True
   - caption