ci: scan workflows with zizmor at the pedantic level

Nothing checked the GitHub Actions workflows for security problems
other than CodeQL's `actions` analysis. That analysis now comes from
CodeQL default setup with the default query suite, which never
reported the 25 action references pinned only by tag, and which does
not run at all on pull requests from forks.

Add a workflow that runs zizmor through `zizmorcore/zizmor-action`
on pushes to `main`, on pull requests, and on manual dispatch, the
same triggers as the other workflows. It uses the action's default
GitHub Advanced Security mode, uploading SARIF so that findings appear
in the Security tab as code scanning alerts. In that mode the action
does not fail on findings, only when zizmor itself fails, including
when it finds nothing to scan. This repository is public, so the
upload needs no paid features. GitHub blocks CodeQL SARIF uploads while
CodeQL default setup is enabled, but that applies only to CodeQL
results, not to zizmor's.

The job uses the `pedantic` persona, which adds code smells to the
default persona's high-signal findings. The `auditor` persona was
also considered. On this repository, its only extra findings are 22
`misfeature` findings, one for each step that runs in the custom
shells that `alpine-test.yml` and `cygwin-test.yml` deliberately use.
zizmor's documentation describes that persona as including findings
that are likely false positives.

`.github/zizmor.yml` turns off two `pedantic` audits whose findings
would not lead to any change here:

- `anonymous-definition` (8 findings): workflows and jobs without
  `name:` are only harder to identify in the Actions UI. zizmor's
  documentation says the audit has no security impact.
- `concurrency-limits` (9 findings): no workflow here needs to cancel
  or serialize overlapping runs.

This is the same zizmor setup as in gitoxide, which uses the
`pedantic` persona and turns off the same two audits. It differs in
following this repository's workflow triggers and style and in using
the `ubuntu-slim` runner, which `zizmor-action` supports since v0.7.0.

`zizmor-action` is pinned by `pinact` to v0.7.1, which runs zizmor
1.31.1, rather than to v0.8.0, which was released two days ago. That
keeps to the 7-day cooldown now configured for Dependabot.

With this configuration, zizmor 1.31.1 run locally at this commit
reports 18 findings: 9 `artipacked`, 6 `template-injection`, and one
each of `excessive-permissions`, `undocumented-permissions`, and
`unpinned-images`. The `unpinned-images` finding is for `alpine:latest`
in `alpine-test.yml`. It is correct, but there is not yet a good way to
act on it, so it is left to be reported rather than suppressed.
`actionlint` reports no problems with the new workflow.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: EliahKagan

.github/workflows/zizmor.yml

@@ -0,0 +1,27 @@
+name: zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions: {}  # Expanded in the `zizmor` job.
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-slim
+
+    permissions:
+      security-events: write  # Required for uploading SARIF to view in the Security tab.
+      contents: read  # Not needed in public repos. (Kept for private forks/reuploads.)
+      actions: read  # Not needed in public repos. (Kept for private forks/reuploads.)
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+
+    - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+      with:
+        persona: pedantic

.github/zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  anonymous-definition:
+    disable: true
+  concurrency-limits:
+    disable: true