Add zizmor GitHub workflow linter (#798)

* Add zizmor GitHub workflow linter and resolve audits

* Fix missing permissions in CI workflow

* Fix missing set pipefail & `needs` for CI job

Suggested by GitHub copilot

* Fix incorrect job name to wait for

* Fix missing CI pr-auto-updater permissions

Author: CarrotManMatt

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+    .github/workflows/**/*.{yml,yaml}:
+        ignore:
+            - missing input "app-id" which is required by action "actions/create-github-app-token@
+            - input "client-id" is not defined in action "actions/create-github-app-token@

.github/workflows/autofix-pre-commit.yaml

@@ -10,6 +10,10 @@ name: autofix.ci
                 required: false
                 type: boolean
 
+concurrency:  # yamllint disable-line rule:key-ordering
+    cancel-in-progress: true
+    group: autofix-pre-commit-${{github.event.pull_request.number||github.ref}}
+
 permissions:
     contents: read
 
@@ -19,19 +23,22 @@ jobs:
             UV_FROZEN: true
             UV_NO_SYNC: true
             UV_PYTHON_DOWNLOADS: never
+        name: Run pre-commit hooks and commit any auto-fixes
         runs-on: ubuntu-latest
 
         steps:
             - uses: actions/checkout@v7
+              with:
+                persist-credentials: false
 
-            - name: Add GB Locale
+            - name: Add GB locale
               run: |
                 sudo apt-get update
                 sudo apt-get install -y locales
                 sudo locale-gen en_GB.UTF-8
               shell: bash
 
-            - name: Set Up Python
+            - name: Set up Python
               uses: actions/setup-python@v6
               with:
                 python-version-file: .python-version
@@ -41,11 +48,11 @@ jobs:
               with:
                 enable-cache: true
 
-            - name: Install prek From Locked Dependencies
+            - name: Install prek from locked dependencies
               run: uv sync --only-group pre-commit
 
             - id: store-hashed-python-version
-              name: Store Hashed Python Version
+              name: Store hashed Python version
               run: echo "hashed_python_version=$(uv run -- python -VV | sha256sum | cut -d' ' -f1)"
                 >> "$GITHUB_OUTPUT"
 
@@ -54,19 +61,25 @@ jobs:
                 key: prek|${{steps.store-hashed-python-version.outputs.hashed_python_version}}|${{hashFiles('.pre-commit-config.yaml')}}
                 path: ~/.cache/prek
 
-            - name: Setup pre-commit Environments
+            - name: Setup pre-commit environments
               run: uv run -- prek install-hooks
 
             - name: Run prek
-              run: |
+              env:  # yamllint disable-line rule:key-ordering
+                CURRENT_BRANCH_NAME: ${{github.ref_name}}
+                DEFAULT_BRANCH_NAME: ${{github.event.repository.default_branch}}
+              run: |  # zizmor: ignore[template-injection]
                 set -o pipefail
-                if [[ "${{github.event_name}}" == "push" && "${{github.ref_name}}" == "${{github.event.repository.default_branch}}" ]]; then
-                    uv run -- prek run --all-files --hook-stage manual --color never --skip ruff-check --skip uv-lock --skip gitlint-ci | tee /tmp/prek.log
+
+                if [ "${{github.event_name}}" == "push" ] && [ "${CURRENT_BRANCH_NAME}" == "${DEFAULT_BRANCH_NAME}" ]; then
+                    ARGS=("--skip" "gitlint-ci")
                 else
-                    uv run -- prek run --all-files --hook-stage manual --color never --skip ruff-check --skip uv-lock | tee /tmp/prek.log
+                    ARGS=()
                 fi
 
-            - name: Ensure No Warnings
+                uv run -- prek run --all-files --hook-stage manual --color never --skip ruff-check --skip uv-lock "${ARGS[@]}" | tee /tmp/prek.log
+
+            - name: Ensure no warnings
               run: "if grep -q '^warning: ' /tmp/prek.log; then exit 1; fi"
 
             - if: "!cancelled() && inputs.skip-autofix != true"