Add zizmor GitHub Actions static analysis

[blarghmatey]

What are the relevant tickets?

N/A

Description (What does it do?)

Hardens the supply-chain security posture of this repo's GitHub Actions workflows by adding zizmor, a static analysis tool for GitHub Actions YAML that catches issues like script injection via untrusted input, overly broad permissions: blocks, unpinned/mutable action references, and other common workflow misconfigurations. Mirrors the pattern already rolled out to mitodl/mit-learn, mitodl/ol-django, mitodl/ol-keycloak, and others.

1. New CI workflow — .github/workflows/actions-static-analysis.yml runs zizmor via zizmorcore/zizmor-action (pinned to v0.6.2 by commit SHA) on push to anything under .github/workflows/**. It scans .github/workflows/ and fails on findings at high severity / medium confidence or above. The workflow itself follows least-privilege practice: top-level permissions: {} with only contents: read and actions: read granted to the job, and the checkout step uses persist-credentials: false.

2. New pre-commit hook — .pre-commit-config.yaml gains a zizmorcore/zizmor-pre-commit entry (pinned to v1.29.0) using the zizmor hook ID, so contributors get the same linting feedback locally before pushing, not just in CI.

3. Existing workflows fixed — ran zizmor --fix=all against this repo's pre-existing workflow files, which auto-applies zizmor's safe fixes (pinning unpinned action refs to commit SHAs, adding persist-credentials: false). This cleared every high-severity finding zizmor reports against this repo. Remaining findings are medium severity or below and don't trip the new workflow's min-severity: high gate.

Screenshots (if appropriate):

N/A - no UI changes.

How can this be tested?

• Review .github/workflows/actions-static-analysis.yml directly — confirm it only triggers on changes under .github/workflows/**, uses SHA-pinned action references, and grants the job only contents: read and actions: read.
• After merge, the new "GitHub Actions Static Analysis" check will run automatically on any future PR that touches workflow YAML.
• The action-ref pin changes in existing workflows are behavior-preserving: each pinned SHA was verified to be the exact commit the previous mutable ref (tag or branch) currently resolves to.

Additional Context

Part of an org-wide zizmor rollout; this repo was in the first wave, scoped to repos with GitHub Actions workflows that had the most recent push activity.

[Copilot]

🟡 Changes recommended

The missing pull-request trigger leaves workflow changes from forks untested.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds zizmor-based static analysis to harden GitHub Actions security.

Changes:

• Adds CI and pre-commit zizmor checks.
• Disables persisted checkout credentials across workflows.
• Pins and documents action versions.

File summaries

File	Description
.pre-commit-config.yaml	Adds the zizmor hook.
.github/workflows/actions-static-analysis.yml	Adds workflow security analysis.
.github/workflows/ci.yml	Hardens checkout credentials.
.github/workflows/canary.yml	Hardens checkout credentials.
.github/workflows/plugin-compat.yml	Hardens both checkout steps.
.github/workflows/settings-verify.yml	Hardens both checkout steps.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.