feat(79894): add zizmor workflow security audit and pin all action SHAs #14

	name: ci.yml

	permissions:
	contents: read

	on:
	pull_request:
	push:
	branches:
	- main

	jobs:
	test-scripts:
	name: Test Python scripts
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Setup Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: '3.x'

	- name: Install pytest
	run: pip install pytest

	- name: Run script tests
	run: pytest scripts/ -v

	zizmor:
	name: Workflow security audit (zizmor)
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	persist-credentials: false

	- name: Run zizmor
	uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

Provide feedback