rtibbles · Oct 25, 2026 · Oct 25, 2026 · Oct 25, 2026 · Oct 25, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,5 +1,3 @@
-# Automatically update versions for pip
-
 version: 2
 updates:
   # Maintain dependencies for Node
@@ -11,7 +9,7 @@ updates:
     cooldown:
       default-days: 7
   # Maintain dependencies for Python
-  - package-ecosystem: 'pip'
+  - package-ecosystem: 'uv'
     directory: '/'
     schedule:
       interval: 'monthly'
@@ -30,3 +28,14 @@ updates:
       github:
         patterns:
           - 'actions/*'
+  - package-ecosystem: 'pre-commit'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+      time: '00:00'
+    cooldown:
+      default-days: 7
+    groups:
+      pre-commit:
+        patterns:
+          - '*'
diff --git a/.github/workflows/community-contribution-label.yml b/.github/workflows/community-contribution-label.yml
@@ -13,8 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check event context
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          EVENT_ACTION: ${{ github.event.action }}
         run: |
-          if [[ "${{ github.event_name }}" != "issues" ]] || [[ "${{ github.event.action }}" != "assigned" && "${{ github.event.action }}" != "unassigned" ]]; then
+          if [[ "$EVENT_NAME" != "issues" ]] || [[ "$EVENT_ACTION" != "assigned" && "$EVENT_ACTION" != "unassigned" ]]; then
           echo "This workflow should only run on issue assigned/unassigned events"
           exit 1
           fi
@@ -29,15 +32,11 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
-      - name: Set up Python
-        uses: actions/setup-python@v7
+          permission-issues: write
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
-          python-version: '3.x'
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install requests
+          enable-cache: false
       - name: Add/Remove Community Contribution Label
-        run: python .github-repo/scripts/community-contribution-label.py
+        run: uv run --project .github-repo --no-dev --locked .github-repo/scripts/community-contribution-label.py
         env:
           token: ${{ steps.generate-token.outputs.token }}
diff --git a/.github/workflows/contributor-issue-comment.yml b/.github/workflows/contributor-issue-comment.yml
@@ -14,6 +14,8 @@ on:
       SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL:
         required: true
         description: 'Webhook URL for Slack #support-dev-notifications channel'
+permissions:
+  contents: read
 jobs:
   check-if-contributor:
     name: Check if author is contributor
@@ -36,12 +38,13 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-issues: write
+          permission-pull-requests: read
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/contributor-pr-reply.yml b/.github/workflows/contributor-pr-reply.yml
@@ -11,6 +11,8 @@ on:
       SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL:
         required: true
         description: 'Webhook URL for Slack #support-dev-notifications channel'
+permissions:
+  contents: read
 jobs:
   check-if-contributor:
     name: Check if author is contributor
@@ -33,12 +35,13 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-issues: read
+          permission-pull-requests: write
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/dependabot-reviewer.yml b/.github/workflows/dependabot-reviewer.yml
@@ -24,8 +24,11 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-pull-requests: write
       - name: Request review
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
           GH_REPO: ${{ github.repository }}
-        run: gh pr edit ${{ github.event.pull_request.number }} --add-reviewer ${{ inputs.reviewer }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REVIEWER: ${{ inputs.reviewer }}
+        run: gh pr edit "$PR_NUMBER" --add-reviewer "$REVIEWER"
diff --git a/.github/workflows/good-first-issue-comment.yml b/.github/workflows/good-first-issue-comment.yml
@@ -18,12 +18,12 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-issues: write
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/holiday-message.yml b/.github/workflows/holiday-message.yml
@@ -11,6 +11,8 @@ on:
       SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL:
         required: true
         description: 'Webhook URL for Slack #support-dev-notifications channel'
+permissions:
+  contents: read
 jobs:
   check-if-contributor:
     name: Check if author is contributor
@@ -33,12 +35,13 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-issues: write
+          permission-pull-requests: write
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/is-contributor.yml b/.github/workflows/is-contributor.yml
@@ -32,6 +32,7 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-metadata: read
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:

diff --git a/.github/workflows/manage-issue-header.yml b/.github/workflows/manage-issue-header.yml
@@ -18,12 +18,12 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-issues: write
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/pr-statistics.yml b/.github/workflows/pr-statistics.yml
@@ -6,6 +6,8 @@ on:
     - cron: '0 8 * * 1'
   workflow_dispatch:
   # Allow manual triggering for testing
+permissions:
+  contents: read
 jobs:
   generate-pr-statistics:
     runs-on: ubuntu-latest
@@ -16,12 +18,12 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-pull-requests: read
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
@@ -18,9 +18,18 @@ jobs:
         uses: actions/setup-node@v7
         with:
           node-version: '20'
+          cache: yarn
       - name: Install dependencies
         run: yarn install --frozen-lockfile
-      - name: Install prek
-        run: pipx install prek
+      - uses: astral-sh/setup-uv@v10.3.2
+        with:
+          enable-cache: true
+          cache-python: true
+      - name: Install and verify lock
+        run: uv sync --group dev --locked
+      - uses: actions/cache@v6
+        with:
+          path: ~/.cache/prek
+          key: prek-${{ hashFiles('.pre-commit-config.yaml') }}
       - name: Run prek
-        run: prek run --all-files
+        run: uv run prek run --all-files --show-diff-on-failure
diff --git a/.github/workflows/pull-request-label.yml b/.github/workflows/pull-request-label.yml
@@ -8,6 +8,8 @@ on:
       LE_BOT_PRIVATE_KEY:
         description: 'GitHub App Private Key for authentication'
         required: true
+permissions:
+  contents: read
 jobs:
   check-if-contributor:
     name: Check if author is contributor
@@ -30,12 +32,12 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-pull-requests: write
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/pull-request-template.yml b/.github/workflows/pull-request-template.yml
@@ -19,12 +19,12 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-contents: read
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/review-requested.yml b/.github/workflows/review-requested.yml
@@ -8,6 +8,8 @@ on:
       LE_BOT_PRIVATE_KEY:
         description: 'GitHub App Private Key for authentication'
         required: true
+permissions:
+  contents: read
 jobs:
   check-if-contributor:
     name: Check if author is contributor
@@ -30,12 +32,12 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-pull-requests: write
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/sync-automation-template.yml b/.github/workflows/sync-automation-template.yml
@@ -34,7 +34,10 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
-          owner: learningequality
+          owner: learningequality # zizmor: ignore[github-app]
+          permission-contents: write
+          permission-pull-requests: write
+          permission-workflows: write
       - name: Checkout
         uses: actions/checkout@v7
       - name: Setup Node.js

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
 jobs:
   test:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/unassign-inactive-issues.yaml b/.github/workflows/unassign-inactive-issues.yaml
@@ -22,12 +22,14 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-issues: write
+          permission-members: read
+          permission-pull-requests: read
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:
           repository: learningequality/.github
           ref: main
-          token: ${{ steps.generate-token.outputs.token }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:

diff --git a/.github/workflows/update-pr-spreadsheet.yml b/.github/workflows/update-pr-spreadsheet.yml
@@ -23,6 +23,7 @@ jobs:
         with:
           app-id: ${{ secrets.LE_BOT_APP_ID }}
           private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}
+          permission-pull-requests: read
       - name: Checkout .github repository
         uses: actions/checkout@v7
         with:

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        '*': ref-pin
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: check-yaml
@@ -9,19 +9,44 @@ repos:
       - id: debug-statements
       - id: end-of-file-fixer
         exclude: '^.+?\.json$'
+  - repo: https://github.com/astral-sh/uv-pre-commit
+    rev: 0.13.5
+    hooks:
+      - id: uv-lock
   - repo: https://github.com/google/yamlfmt
-    rev: v0.14.0
+    rev: v0.21.0
     hooks:
       - id: yamlfmt
         exclude: '^tests/cassettes|^\.github/workflows/automation(-caller|-group-.+)?\.yml$|^automation-template\.yml$'
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.7
+    rev: v1.7.12
     hooks:
       - id: actionlint
         # Expects shellcheck to be installed on the system
         # https://github.com/koalaman/shellcheck#installing
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.31.1
+    hooks:
+      - id: zizmor
+        args: [--no-progress, --offline, --min-confidence, medium]
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.17.2
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
   - repo: local
     hooks:
+      - id: eslint
+        name: ESLint
+        entry: yarn eslint --fix
+        language: system
+        files: \.js$
+      - id: prettier
+        name: Prettier
+        entry: yarn prettier --write
+        language: system
+        files: \.js$
       - id: generate-automation
         name: Check automation.yml / automation-template.yml are up to date
         entry: node scripts/generate-automation.js --check