Add zizmor GitHub Actions static analysis

.github/workflows/actions-static-analysis.yml

@@ -0,0 +1,35 @@
+---
+name: GitHub Actions Static Analysis
+
+on:
+  push:
+    branches:
+    - "main"
+    paths:
+    - ".github/workflows/**"
+  pull_request:
+    paths:
+    - ".github/workflows/**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
+      with:
+        persist-credentials: false
+
+    - name: Run zizmor 🌈
+      uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054   # v0.6.2
+      with:
+        inputs: ".github/workflows/"
+        min-severity: medium
+        min-confidence: medium
+        advanced-security: false

.github/workflows/canary.yml

@@ -98,7 +98,9 @@ jobs:
         cell: ${{ fromJSON(needs.enumerate.outputs.cells) }}
     name: build ${{ matrix.cell }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     # Installs the CLI and starts an engine that pulls Docker Hub images
     # through a caching mirror; see the action for why.
     - uses: ./.github/actions/dagger-engine

.github/workflows/ci.yml

@@ -12,8 +12,12 @@ concurrency:
 jobs:
   fast-checks:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       with:
         enable-cache: true

.github/workflows/plugin-compat.yml

@@ -46,10 +46,11 @@ jobs:
       any: ${{ steps.matrix.outputs.any }}
       cells: ${{ steps.matrix.outputs.cells }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         # Full history so the PR base is available to diff against.
         fetch-depth: 0
+        persist-credentials: false
     - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       with:
         enable-cache: true
@@ -97,7 +98,9 @@ jobs:
     name: ${{ matrix.cell.group }}/${{ matrix.cell.release }}/${{ matrix.cell.deployment
       }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     # Installs the CLI and starts an engine that pulls Docker Hub images
     # through a caching mirror; see the action for why.
     - uses: ./.github/actions/dagger-engine

.github/workflows/settings-verify.yml

@@ -48,10 +48,11 @@ jobs:
       any: ${{ steps.matrix.outputs.any }}
       cells: ${{ steps.matrix.outputs.cells }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         # Full history so the PR base is available to diff against.
         fetch-depth: 0
+        persist-credentials: false
     - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
@@ -103,7 +104,9 @@ jobs:
     name: settings ${{ matrix.cell.group }}/${{ matrix.cell.release }}/${{ matrix.cell.deployment
       }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     # Installs the CLI and starts an engine that pulls Docker Hub images
     # through a caching mirror; see the action for why.
     - uses: ./.github/actions/dagger-engine

.pre-commit-config.yaml

@@ -114,3 +114,8 @@ repos:
   rev: v2.14.0
   hooks:
   - id: hadolint-docker
+- repo: https://github.com/zizmorcore/zizmor-pre-commit
+  rev: v1.29.0
+  hooks:
+  - id: zizmor
+    args: [--no-progress, --min-severity=medium, --min-confidence=medium]