ci: separate actions job

Author: flying-sheep

.github/workflows/ci.yml

@@ -11,6 +11,18 @@ permissions:
   contents: read
 
 jobs:
+  actions:
+    name: Check GH actions
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required to upload SARIF results
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
   test:
     name: Node.js ${{ matrix.node-version }}
     runs-on: ubuntu-latest
@@ -24,8 +36,6 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Check GH actions
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
       - run: corepack enable
       - name: Install Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -70,6 +80,7 @@ jobs:
   check:
     if: always()
     needs:
+      - actions
       - test
     runs-on: ubuntu-latest
     steps: