CI: Add workflow that runs zizmor latest

[str4d]

Source: woodruffw/zizmor@c6fef48

Motivation

This repository has many GitHub Actions workflows. zizmor is a static analysis tool that can find many common security issues in typical GitHub Actions CI/CD setups, such as the recent Ultralytics workflow vulnerability.

Follow-up Work

zizmor identifies a bunch of problems. I'll open a separate PR to fix the ones I can see how to fix. Nope, there are way too many workflows for me to fix in the time I have available.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[arya2]

Looks good, nice find and thank you for the PR.

Nope, there are way too many workflows for me to fix in the time I have available.

Yep. I tried doing the same. Luckily the vulnerabilities I've seen so far all seem okay until CI is opened up. We may want to ignore the template-injection rule and others to fix the lints one by one.

[mpguerra]

@mergify refresh

[mergify]

refresh

✅ Pull request refreshed