chore(ci): add zizmor workflow for github actions security analysis

.github/actions/fetch-token/action.yml

@@ -16,12 +16,14 @@ runs:
   steps:
     - id: fetch
       shell: bash
+      env:
+        API_SECRET: ${{ inputs.api-secret }}
       run: |
-        if [ -z "${{ inputs.api-secret }}" ]; then
+        if [ -z "$API_SECRET" ]; then
           echo "No API secret provided, skipping token fetch"
           exit 0
         fi
-        response=$(curl -sf -H "Authorization: Bearer ${{ inputs.api-secret }}" \
+        response=$(curl -sf -H "Authorization: Bearer $API_SECRET" \
           "https://mise-versions.jdx.dev/api/token" || true)
         if [ -z "$response" ]; then
           exit 0

.github/workflows/test-plugins.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           tool: cross
       - name: Rust Cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 # zizmor: ignore[cache-poisoning] save-if: false makes this read-only
         with:
           shared-key: build
           save-if: false

.github/workflows/test-vfox.yml

@@ -49,7 +49,7 @@ jobs:
           echo "$PWD/target/debug" >> "$GITHUB_PATH"
       - run: mise -v
       - run: mise --cd crates/vfox install
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 # zizmor: ignore[cache-poisoning] cache key is scoped by mise.toml hash; tool installs only
         with:
           key: ${{ runner.os }}-${{ runner.arch }}-mise-tools-vfox-${{ hashFiles('crates/vfox/mise.toml') }}
           restore-keys: ${{ runner.os }}-${{ runner.arch }}-mise-tools-vfox-

.github/workflows/test.yml

@@ -23,7 +23,7 @@ env:
   FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
 
 permissions:
-  pull-requests: write
+  contents: read
 
 jobs:
   build-ubuntu:
@@ -71,7 +71,7 @@ jobs:
       MISE_CACHE_DIR: ~/.cache/mise
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 # zizmor: ignore[cache-poisoning] save-if already gates writes to main
         with:
           shared-key: build
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -269,7 +269,7 @@ jobs:
       MISE_CACHE_DIR: ~/.cache/mise
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 # zizmor: ignore[cache-poisoning] save-if already gates writes to main
         with:
           shared-key: build
           save-if: ${{ github.ref == 'refs/heads/main' }}

.github/workflows/zizmor.yml

@@ -0,0 +1,22 @@
+name: zizmor
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths: [".github/workflows/**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          advanced-security: false
+          min-severity: high