feat(79894): add zizmor workflow security audit and pin all action SHAs #25

	name: ci.yml

	permissions:
	contents: read

	on:
	pull_request:
	push:
	branches:
	- main

	jobs:
	check-pinned-actions:
	name: Check actions are SHA-pinned
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	persist-credentials: false

	- name: Check actions are SHA-pinned
	uses: suzuki-shunsuke/pinact-action@cf51507d80d4d6522a07348e3d58790290eaf0b6 # v2.0.0
	with:
	skip_push: "true"
	github_token: ${{ secrets.GITHUB_TOKEN }}

	test-scripts:
	name: Test Python scripts
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

	- name: Setup Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
	with:
	python-version: '3.x'

	- name: Install pytest
	run: pip install pytest

	- name: Run script tests
	run: pytest scripts/ -v

	zizmor:
	name: Workflow security audit (zizmor)
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	persist-credentials: false

	- name: Run zizmor
	uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

Provide feedback