ci: add workflow-security.yaml (zizmor + actionlint) (#191)

[Chris-Wolfgang]

Summary

Adds a Workflow Security CI job per #191. Complements CodeQL / DevSkim / Gitleaks (which scan the code) and OSSF Scorecard (which scores the repo config) — this one lints the GitHub Actions YAML for security anti-patterns those tools don't catch: template injection in run:, overly-permissive permissions:, secret leaks via expression expansion, unpinned actions, dangerous triggers.

Changes

• .github/workflows/workflow-security.yaml — two jobs on ubuntu-latest:
  • actionlint (Go) — syntax + shellcheck + expression-syntax. Fails on any finding.
  • zizmor (Python) — security audit rules. Gates on --min-severity=high. Uploads SARIF to Code Scanning for triage of low/medium/informational findings that don't gate.
  • Triggered on PR (paths-filtered to .github/workflows/** + .github/actions/** + .github/zizmor.yml) + push to main + workflow_dispatch.
• .github/zizmor.yml — baseline suppressions with explicit TODOs to remove:
  • unpinned-uses disabled across all workflow files. Try-Pattern uses tag refs (@v7 etc.) for ~48 action references today; fleet convention (feedback_actions_sha_pin) is to SHA-pin all of them, but that hasn't been done here yet. Config comment points at a future SHA-pin PR that removes this suppression.
  • dangerous-triggers ignored for pr.yaml. That workflow uses pull_request_target deliberately (workflow YAML executes from main, mitigating malicious-PR modifications); design documented in docs/WORKFLOW_SECURITY.md.

Baseline verification

Local zizmor --min-severity=high .github/workflows/ reports:

69 findings (52 ignored, 12 suppressed, 4 unsafe fixes): 5 informational, 0 low, 0 medium, 0 high

Gate stays green on main today; fires only on NEWLY-introduced high findings.

Protected-file note

Adds a new workflow file. Detect .NET Projects will fail as expected → admin-bypass at merge.

After merge

• First PR that touches .github/workflows/** triggers the new job and confirms both tools run clean against the current baseline.
• Follow-up PR (or fleet sweep): SHA-pin every action reference across pr.yaml, release.yaml, benchmarks.yaml, build-all-versions.yaml, codeql.yaml, docfx.yaml, scorecard.yml, stryker.yaml, and the new workflow-security.yaml. Then delete the unpinned-uses block from .github/zizmor.yml. Local re-run should show 0 ignored on that rule.

Test plan

• YAML parses; 2 jobs (actionlint + zizmor); permissions floor: contents:read + security-events:write on zizmor for SARIF
• Baseline: 0 high after .github/zizmor.yml suppressions
• .github/zizmor.yml lists every current workflow file (with a comment reminding to add new ones)
• Both tool comments explain the "why" not just the "what"
• Real CI proof: workflow runs green on first PR (verify after merge)

Closes #191

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.