ci: add zizmor GitHub Actions audit

[jdx]

Adds a SHA-pinned zizmor workflow for pushes to main and pull requests. Findings are uploaded to GitHub code scanning via SARIF.

---

Note

Low Risk
Adds read-only CI security scanning with scoped permissions and pinned actions; no application or production runtime changes.

Overview
Adds a new zizmor workflow that runs on pushes to main and on pull requests to scan GitHub Actions definitions for security issues.

The workflow uses minimal default permissions (permissions: {}) and grants security-events: write only on the audit job so findings can be reported (e.g. to code scanning via the pinned zizmorcore/zizmor-action). Checkout is SHA-pinned and uses persist-credentials: false, consistent with other workflows in the repo.

^{Reviewed by Cursor Bugbot for commit c8f0753. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features
  • Added automated security analysis for code changes submitted through pushes and pull requests.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 8f2f5a3e-6824-4bf6-8f14-aad473be09e0

📥 Commits

Reviewing files that changed from the base of the PR and between b8fa9a1 and c8f0753.

📒 Files selected for processing (1)

• .github/workflows/zizmor.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow that runs pinned Zizmor security analysis on pushes to main and pull requests. The workflow uses restricted permissions and disables persisted checkout credentials.

Changes

Security analysis workflow

Layer / File(s)	Summary
Configure Zizmor workflow .github/workflows/zizmor.yml	Adds push and pull-request triggers, restricted permissions, an Ubuntu job, pinned action versions, and checkout with persisted credentials disabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to c8f07

This adds automated Zizmor analysis for main pushes and pull requests with SARIF reporting; the workflow is configured with hardened action usage and no current merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of a Zizmor GitHub Actions security audit workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}