ci: adding more precommit hooks

.pre-commit-config.yaml

@@ -12,33 +12,33 @@ ci:
 
 
 repos:
--   repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.11.0.1
-    hooks:
-    -   id: shellcheck
-        args: [ "-x"]
+- repo: https://github.com/shellcheck-py/shellcheck-py
+  rev: 745eface02aef23e168a8afb6b5737818efbea95 # v0.11.0.1
+  hooks:
+    - id: shellcheck
+      args: [ "-x"]
 
 - repo: https://github.com/pre-commit/mirrors-mypy
-  rev: v1.19.0
+  rev: c2738302f5cf2bfb559c1f210950badb133613ea # v1.19.0
   hooks:
     - id: mypy
       args: [ --follow-imports=silent, --config-file=pyproject.toml]
       exclude: ^(doc/|examples/)
 
 - repo: https://github.com/ansys/pre-commit-hooks
-  rev: v0.5.2
+  rev: fd1d6b0b4baeb08e32d4de0909999576695c0433 #v0.5.2
   hooks:
   - id: add-license-headers
     args:
     - --start_year=2016
 
 - repo: https://github.com/pycqa/isort
-  rev: 7.0.0
+  rev: 0a09c783808cfe77bb3269250f663ff733d23302 # 7.0.0
   hooks:
   - id: isort
 
 - repo: https://github.com/numpy/numpydoc
-  rev: v1.10.0
+  rev: 16a20aad58d5532fb12c2a87af0eb4ea290bacb4 # v1.10.0
   hooks:
     - id: numpydoc-validation
       exclude: |
@@ -51,25 +51,25 @@ repos:
           )
 
 - repo: https://github.com/adamchainz/blacken-docs
-  rev: 1.20.0
+  rev: fda77690955e9b63c6687d8806bafd56a526e45f # 1.20.0
   hooks:
   - id: blacken-docs
     additional_dependencies: [black==25.12.0]
 
 - repo: https://github.com/psf/black-pre-commit-mirror
-  rev: 25.12.0  # If version changes --> modify "blacken-docs" manually as well.
+  rev: 831207fd435b47aeffdf6af853097e64322b4d44 # 25.12.0  # If version changes --> modify "blacken-docs" manually as well.
   hooks:
   - id: black
     args:
       - --line-length=88
 
 - repo: https://github.com/PyCQA/flake8
-  rev: 7.3.0
+  rev: c48217e1fc006c2dddd14df54e83b67da15de5cd # 7.3.0
   hooks:
   - id: flake8
 
 - repo: https://github.com/codespell-project/codespell
-  rev: v2.4.1
+  rev: 63c8f8312b7559622c0d82815639671ae42132ac # v2.4.1
   hooks:
   - id: codespell
     args: ["--toml", "pyproject.toml"]
@@ -83,20 +83,35 @@ repos:
 #     exclude: "tests/"
 
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v6.0.0
+  rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
   hooks:
   - id: check-merge-conflict
   - id: debug-statements
 
 # this validates our github workflow files
 - repo: https://github.com/python-jsonschema/check-jsonschema
-  rev: 0.35.0
+  rev: b32b2911704f67f5319d0a7630394cb6b07df851 # 0.35.0
   hooks:
     - id: check-github-workflows
 
 - repo: https://github.com/ComPWA/taplo-pre-commit
-  rev: v0.9.3
+  rev: ade0f95ddcf661c697d4670d2cfcbe95d0048a0a # v0.9.3
   hooks:
     - id: taplo-format
       # See options: https://taplo.tamasfe.dev/configuration/formatter-options.html
       args: [--option, "reorder_arrays=true", --option, "reorder_keys=true"]
+
+- repo: https://github.com/zizmorcore/zizmor-pre-commit
+  rev: 1e30511413f07e516c1844ba91abce8aca984963 # 1.18.0
+  hooks:
+    - id: zizmor
+      args: ["--pedantic"]
+
+# Security checks with bandit
+- repo: https://github.com/PyCQA/bandit
+  rev: ea0d187d78b2e6365e35f676d2eb9b1be264c091 # 1.9.2
+  hooks:
+    - id: bandit
+      args: ['-c', 'pyproject.toml']
+      additional_dependencies: ['bandit[toml]']
+      exclude: ^tests/