pre-commit: Add zizmor and replace prettier with rumdl

Author: cclauss

.devcontainer/README.md

@@ -13,14 +13,15 @@ This is **Devcontainer** configuration to provide a consistent development envir
 
 ## Usage
 
-1. Install [**Docker** ](https://www.docker.com/get-started/) and [**Visual Studio Code**](https://code.visualstudio.com/)
+1. Install [**Docker**](https://www.docker.com/get-started/) and [**Visual Studio Code**](https://code.visualstudio.com/)
 2. Install the **Remote - Containers** extension in VS Code
 
     - Do `CTRL+P`, paste this command and press `Enter`
 
         ```shell
         ext install ms-vscode-remote.remote-containers
         ```
+
 3. Open this repository in VS Code
 4. When prompted, click **"Reopen in Container"**
 5. Wait for the environment to build and initialize

.github/dependabot.yml

@@ -6,3 +6,5 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7

.github/pull_request_template.md

@@ -1,17 +1,16 @@
-### Describe your change:
-
-
+### Describe your change
 
 * [ ] Add an algorithm?
 * [ ] Fix a bug or typo in an existing algorithm?
 * [ ] Add or change doctests? -- Note: Please avoid changing both code and tests in a single pull request.
 * [ ] Documentation change?
 
-### Checklist:
+### Checklist
+
 * [ ] I have read [CONTRIBUTING.md](https://github.com/TheAlgorithms/Python/blob/master/CONTRIBUTING.md).
 * [ ] This pull request is all my own work -- I have not plagiarized.
 * [ ] I know that pull requests will not be merged if they fail the automated tests.
-* [ ] This PR only changes one algorithm file.  To ease review, please open separate PRs for separate algorithms.
+* [ ] This PR only changes one algorithm file. To ease review, please open separate PRs for separate algorithms.
 * [ ] All new Python files are placed inside an existing directory.
 * [ ] All filenames are in all lowercase characters with no spaces or dashes.
 * [ ] All functions and variable names follow Python naming conventions.

.github/skills/code-review/SKILL.md

@@ -69,7 +69,7 @@ flagged. Also, paste the concrete command you ran.
 
 Emit exactly these headings so reviews are comparable and easy to automate:
 
-```
+```text
 ### Is this an algorithm? — <yes/no + one-line why>
 ### Duplicate / prior-art check — <#NNNN | none found>
 ### Coding style — <pass | issues: …>

.github/skills/new-pull-request/SKILL.md

@@ -10,7 +10,7 @@ clear, kind, tested, type-hinted, mergeable contribution.
 Make sure that the local `master` branch is synced with `upstream/master` before
 creating a new pull request.
 
-Create a new clearly named branch for the pull request.  Pull request changes must
+Create a new clearly named branch for the pull request. Pull request changes must
 not be made or submitted on the `master` branch.
 
 Never hand-edit or revert the `uv.lock` file. If you add a legitimate
@@ -19,7 +19,7 @@ hand. A hand-modified `uv.lock` makes the `algorithms-keeper` bot close the pull
 request as invalid, and even a repo maintainer cannot undo that.
 
 Always check at least one Markdown checkbox in the pull request description (the "Describe your change" section), or the
-`algorithms-keeper` bot will close the pull request as invalid.  Any repo maintainer can undo this if you @mention them on the closed pull request.
+`algorithms-keeper` bot will close the pull request as invalid. Any repo maintainer can undo this if you @mention them on the closed pull request.
 
 ### 1. Before contributing / Is this an algorithm?
 

.github/workflows/build.yml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true

.github/workflows/devcontainer_ci.yml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: devcontainers/ci@v0.3
         with:
           push: never

.github/workflows/directory_writer.yml

@@ -9,6 +9,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@v7
         with:
           python-version-file: .python-version

.github/workflows/hacktoberfest_prep.yml

@@ -29,6 +29,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v7
         with:
           python-version-file: .python-version
@@ -96,4 +98,6 @@ jobs:
             echo "Open tracker PR already exists; force-push updated it in place."
           fi
       - name: Propagate the script's exit code
-        run: exit ${{ steps.update.outputs.exit_code }}
+        env:
+          UPDATE_EXIT_CODE: ${{ steps.update.outputs.exit_code }}
+        run: exit ${UPDATE_EXIT_CODE}

.github/workflows/project_euler.yml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@v7
       - uses: actions/setup-python@v7
         with:
@@ -26,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@v7
       - uses: actions/setup-python@v7
         with: