Clean up workflow files from Zizmor output

.github/workflows/cd.yml

@@ -15,32 +15,45 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Install poetry
         run: pipx install poetry
+
       - name: Set up Python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: '3.9'
           cache: 'poetry'
+
       - name: Setup
         run: poetry env use 3.9
+
       - name: Environment information
         run: poetry env info
+
       - name: Log in to Azure
         uses: bitwarden/gh-actions/azure-login@main
         with:
           subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
           tenant_id: ${{ secrets.AZURE_TENANT_ID }}
           client_id: ${{ secrets.AZURE_CLIENT_ID }}
+
       - name: Get Azure Key Vault secrets
         id: get-kv-secrets
         uses: bitwarden/gh-actions/get-keyvault-secrets@main
         with:
           keyvault: gh-passwordless-python
           secrets: "PYPI-TOKEN"
+
       - name: Log out from Azure
         uses: bitwarden/gh-actions/azure-logout@main
+
       - name: Configure PYPI
-        run: poetry config pypi-token.pypi ${{ steps.get-kv-secrets.outputs.PYPI-TOKEN }}
+        env:
+          PYPI_TOKEN: ${{ steps.get-kv-secrets.outputs.PYPI-TOKEN }}
+        run: poetry config pypi-token.pypi "${PYPI_TOKEN}"
+
       - name: Publish to PYPI
         run: poetry publish --build

.github/workflows/ci.yml

@@ -21,29 +21,42 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Install poetry
         run: pipx install poetry
+
       - name: Set up Python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: '3.9'
           cache: 'poetry'
+
       - name: Setup
         run: poetry env use 3.9
+
       - name: Environment information
         run: poetry env info
+
       - name: Build
         run: poetry install --with dev,test
+
       - name: Run isort
         run: poetry run isort . --check-only
+
       - name: Run docformatter
         run: poetry run docformatter --in-place --config ./pyproject.toml src/
+
       - name: Run black
         run: poetry run black . --check
+
       - name: Run flake8
         run: poetry run flake8 .
+
       - name: Run mypy
         run: poetry run mypy .
+
       - name: Test
         run: poetry run pytest
 
@@ -56,17 +69,24 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Install poetry
         run: pipx install poetry
+
       - name: Set up Python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: '3.9'
           cache: 'poetry'
+
       - name: Setup
         run: poetry env use 3.9
+
       - name: Environment information
         run: poetry env info
+
       - name: Build
         run: |
           cd examples/flask
@@ -81,19 +101,25 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Install poetry
         run: pipx install poetry
+
       - name: Set up Python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: '3.9'
           cache: 'poetry'
+
       - name: Setup
         run: poetry env use 3.9
+
       - name: Environment information
         run: poetry env info
+
       - name: Build
         run: |
           cd examples/streamlit
-          poetry install --with dev
-
+          poetry install --with dev