From 6a43873dec4d1d2777f42c5941e4515a99fb97a0 Mon Sep 17 00:00:00 2001
From: Nick Murphy <namurphy@cfa.harvard.edu>
Date: Wed, 26 Aug 2026 15:08:47 -0400
Subject: [PATCH 1/4] Remove token step from workflow to upgrade uv.lock

---
 .github/upgrade-uv-lock.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/upgrade-uv-lock.yml b/.github/upgrade-uv-lock.yml
index af49bb3..f8f37b5 100644
--- a/.github/upgrade-uv-lock.yml
+++ b/.github/upgrade-uv-lock.yml
@@ -78,4 +78,3 @@ jobs:
         branch: upgrade-uv-lock
         base: main
         delete-branch: true
-        token: ${{ steps.generate_token.outputs.token }}

From ee473805da20179f152c5ad800f28dad38a7a0bb Mon Sep 17 00:00:00 2001
From: Nick Murphy <namurphy@cfa.harvard.edu>
Date: Wed, 26 Aug 2026 15:18:04 -0400
Subject: [PATCH 2/4] Fix an import-ant static type checking error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Get it? 🥁
---
 noxfile.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/noxfile.py b/noxfile.py
index e4a2fdd..d53e259 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -24,6 +24,7 @@
 import os
 
 import nox
+import nox.command
 import nox_uv
 
 nox.options.default_venv_backend = "uv"

From a803869c4250c1eecb78d14cddb1468a99cf2900 Mon Sep 17 00:00:00 2001
From: Nick Murphy <namurphy@cfa.harvard.edu>
Date: Wed, 26 Aug 2026 15:19:36 -0400
Subject: [PATCH 3/4] Add configuration file for zizmor workflow security
 checks

---
 .github/zizmor.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..20384ce
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,21 @@
+# zizmor finds potential security vulnerabilities in GitHub workflow
+# files. Documentation: https://woodruffw.github.io/zizmor
+
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        astral-sh/setup-uv: ref-pin
+        codecov/codecov-action: ref-pin
+        conda-incubator/setup-miniconda: ref-pin
+        mamba-org/setup-micromamba: ref-pin
+        heliophysicsPy/pyhc-actions/*: ref-pin
+        pypa/*: ref-pin
+        scientific-python/*: ref-pin
+        ts-graphviz/setup-graphviz: ref-pin
+
+# Put settings that we intend to fix later on below this line. If we
+# decide that a potential security vulnerability does not necessitate a
+# fix, append a comment like `# zizmor: ignore[unpinned-uses]` to the
+# line or set the appropriate configuration options above.

From 9fe378de83b807d5bb4aeb8b31ed20fda54ff44a Mon Sep 17 00:00:00 2001
From: Nick Murphy <namurphy@cfa.harvard.edu>
Date: Wed, 26 Aug 2026 15:22:55 -0400
Subject: [PATCH 4/4] Update workflow permissions

---
 .github/workflows/upgrade-uv-lock.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/upgrade-uv-lock.yml b/.github/workflows/upgrade-uv-lock.yml
index f8f37b5..300b0b9 100644
--- a/.github/workflows/upgrade-uv-lock.yml
+++ b/.github/workflows/upgrade-uv-lock.yml
@@ -10,8 +10,10 @@ on:
   - cron: 37 11 * * 1
   workflow_dispatch:
 
+permissions: {}  # disable all GitHub permissions for the workflow
+
 jobs:
-  upgrade-requirements:
+  upgrade-requirements: # zizmor:ignore[excessive-permissions]
     name: Upgrade uv.lock
     runs-on: ubuntu-latest
     if: github.repository == 'PlasmaPy/pyfaradaycup'