chore: Sync with WeblateOrg/meta

.github/workflows/closing.yml

@@ -9,6 +9,10 @@ on:
   issues:
     types: [closed]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -24,7 +28,11 @@ jobs:
       if: |
         github.actor != 'renovate[bot]' &&
         github.event.issue.state_reason == 'completed' &&
-        (contains(github.event.issue.labels.*.name, 'question') && ! contains(github.event.issue.labels.*.name, 'duplicate') && ! contains(github.event.issue.labels.*.name, 'wontfix')) || join(github.event.issue.labels.*.name) == ''
+        (
+          contains(github.event.issue.labels.*.name, 'question') &&
+          ! contains(github.event.issue.labels.*.name, 'duplicate') &&
+          ! contains(github.event.issue.labels.*.name, 'wontfix')
+        ) || join(github.event.issue.labels.*.name) == ''
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         issue-number: ${{ github.event.issue.number }}

.github/workflows/docker.yml

@@ -72,3 +72,5 @@ jobs:
         platforms: linux/amd64,linux/arm64
         cache-from: type=gha
         cache-to: type=gha,mode=max
+permissions:
+  contents: read

.github/workflows/pre-commit.yml

@@ -8,7 +8,6 @@ name: Pre-commit check
 on:
   push:
     branches-ignore:
-    - deepsource-fix-**
     - renovate/**
     - weblate
   pull_request:
@@ -35,13 +34,13 @@ jobs:
       id: detect
       run: |
         if test -f requirements-lint.txt ; then
-          echo "method=requirements" >> $GITHUB_OUTPUT
+          echo "method=requirements" >> "$GITHUB_OUTPUT"
         elif test -f pyproject.toml && grep -q dependency-groups pyproject.toml ; then
-          echo "method=pep735" >> $GITHUB_OUTPUT
+          echo "method=pep735" >> "$GITHUB_OUTPUT"
         elif test -f pyproject.toml && grep -q dependency-groups pyproject.toml ; then
-          echo "method=pyproject" >> $GITHUB_OUTPUT
+          echo "method=pyproject" >> "$GITHUB_OUTPUT"
         else
-          echo "method=uvx" >> $GITHUB_OUTPUT
+          echo "method=uvx" >> "$GITHUB_OUTPUT"
         fi
     - name: pre-commit (PEP 735)
       if: steps.detect.outputs.method == 'pep735'
@@ -60,7 +59,7 @@ jobs:
       run: uv pip install --system -r requirements-lint.txt
     - name: Install dependencies
       if: steps.detect.outputs.method == 'pyproject'
-      run: uv pip install --system $(sed -n 's/.*"\(pre-commit==\([^"]*\)\)".*/\1/p' pyproject.toml)
+      run: uv pip install --system "$(sed -n 's/.*"\(pre-commit==\([^"]*\)\)".*/\1/p' pyproject.toml)"
     - name: pre-commit (installed)
       if: steps.detect.outputs.method == 'requirements' || steps.detect.outputs.method == 'pyproject'
       run: pre-commit run --all

.github/workflows/release.yml

@@ -19,3 +19,5 @@ jobs:
     - uses: ncipollo/release-action@v1
       with:
         generateReleaseNotes: true
+permissions:
+  contents: read

.pre-commit-config.yaml

@@ -47,5 +47,9 @@ repos:
   hooks:
   - id: reuse
 
+- repo: https://github.com/rhysd/actionlint
+  rev: v1.7.7
+  hooks:
+  - id: actionlint
 ci:
   autoupdate_schedule: quarterly