Add Zizmor pre-commit hook

This also updates Ruff to the latest version and bumps the target Python
version to 3.13, although it doesn't carry any changes with it for now.

.github/workflows/pre-commit.yml

@@ -15,11 +15,13 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Pre-commit
         uses: pre-commit/action@v3.0.1

.pre-commit-config.yaml

@@ -1,10 +1,15 @@
 ---
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.7.4
+    rev: v0.8.2
     hooks:
       - id: ruff
         args:
           - --fix
           - --exit-non-zero-on-fix
       - id: ruff-format
+
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.8.0
+    hooks:
+      - id: zizmor

pyproject.toml

@@ -19,7 +19,7 @@ requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
 
 [tool.ruff]
-target-version = "py38"
+target-version = "py313"
 
 [tool.ruff.lint]
 select = ["ALL"]