ci: run zizmor directly

[johanpel]

Description

Replace the CI pre-commit wrapper with a direct pinned zizmor invocation.

🤖 Generated with Codex

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: QUIET

Plan: Enterprise

Run ID: 74268526-b384-4b18-8b85-d0fb88ebe2fd

📥 Commits

Reviewing files that changed from the base of the PR and between f89cc3a and a67c795.

📒 Files selected for processing (2)

• .github/workflows/checks.yml
• .pre-commit-config.yaml

💤 Files with no reviewable changes (1)

• .pre-commit-config.yaml

---

📝 Walkthrough

Walkthrough

The pull request replaces the pre-commit workflow job with a dedicated GitHub Actions security scan using astral-sh/setup-uv and zizmor. The configured zizmor pre-commit hook is removed.

Changes

GitHub Actions security scanning

Layer / File(s)	Summary
Replace pre-commit security scanning .github/workflows/checks.yml, .pre-commit-config.yaml	The workflow now installs uv and runs zizmor in GitHub reporting mode; the zizmor pre-commit hook is removed.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description only fills the Description section and omits Related Issues, Testing, and Screenshots from the template.	Add the Related Issues, Testing, and Screenshots sections, or note that they are not applicable if unused.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately describes the main change: running zizmor directly in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[mbrobbel]

What is the motivation for this change?

[johanpel]

What is the motivation for this change?

I find pre-commit annoying, our CI runs quickly, and this was the only check in pre-commit, so it felt a bit weird to configure it like this.

[johanpel]

/merge