ci: add zizmor scanning and harden workflows

Now that we build and publish images which are referenced in the
manifest, let's harden the CI workflows using zizmor.

This also matches what we did in chunkah:
coreos/chunkah#122

Assisted-by: Pi (Claude Opus 4.6)

Author: jlebon

.github/workflows/ci.yaml

@@ -10,22 +10,28 @@ on:
 env:
   BINK_VERSION: v0.1.1
 
+permissions: {}
+
 concurrency:
   group: ci-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
 jobs:
   unit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: true # zizmor: ignore[cache-poisoning]
 
       - name: Unit tests
         run: make unit
@@ -46,7 +52,9 @@ jobs:
       IMAGE: ghcr.io/${{ github.repository }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download bink release
         run: |
@@ -55,10 +63,10 @@ jobs:
           sudo chmod +x /usr/local/bin/bink
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: true # zizmor: ignore[cache-poisoning]
 
       - name: Set up KVM
         run: sudo chmod 666 /dev/kvm
@@ -90,15 +98,21 @@ jobs:
 
       - name: Push to GHCR
         if: github.event_name == 'push'
+        env:
+          ACTOR: ${{ github.actor }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SHA: ${{ github.sha }}
+          REF: ${{ github.ref }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          podman login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ghcr.io
-          podman push bootc-operator:dev ${{ env.IMAGE }}:dev
-          podman push bootc-operator:dev ${{ env.IMAGE }}:${{ github.sha }}
+          podman login -u "${ACTOR}" -p "${GH_TOKEN}" ghcr.io
+          podman push bootc-operator:dev "${IMAGE}":dev
+          podman push bootc-operator:dev "${IMAGE}":"${SHA}"
 
-          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
-            podman push bootc-operator:dev ${{ env.IMAGE }}:${{ github.ref_name }}
+          if [[ "${REF}" == refs/tags/v* ]]; then
+            podman push bootc-operator:dev "${IMAGE}":"${REF_NAME}"
           fi
 
-          if [[ "${{ github.ref }}" == refs/heads/main ]]; then
-            podman push bootc-operator:dev ${{ env.IMAGE }}:latest
+          if [[ "${REF}" == refs/heads/main ]]; then
+            podman push bootc-operator:dev "${IMAGE}":latest
           fi

.github/workflows/zizmor.yml

@@ -0,0 +1,24 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Scan GHA workflows
+    runs-on: ubuntu-24.04
+    permissions:
+      security-events: write # Required to upload SARIF files
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6