fix(ci): resolve all zizmor findings and add zizmor pre-commit checks

[gforsyth]

Similar to upstream changes in shared-workflows, this PR cleans up and annotates all of the workflows and adds the zizmor linter to make sure changes are checked.

Part of rapidsai/build-planning#275

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Hardened CI by default-denying token scopes and adding explicit, minimal job-level permissions.
  • Pinned external workflow/action references to specific commits for reproducibility.
  • Updated workflow trigger annotations to suppress tooling warnings where needed.
  • Added permissions to allow automation to update project boards.
  • Integrated Zizmor into pre-commit and added a Zizmor ruleset to enforce pinning of workflow/action references.

Walkthrough

Top-level GitHub Actions permissions are default-denied and replaced by explicit, per-job permission declarations across several workflows; Zizmor is added and configured; one job gains repository-projects: write; some actions are pinned to specific SHAs. No source code or public API changes.

Changes

Cohort / File(s)	Summary
Workflow Permission Hardening \.github/workflows/build.yaml, \.github/workflows/pr.yaml, \.github/workflows/test.yaml, \.github/workflows/trigger-breaking-change-alert.yaml	Added top-level permissions: {} and explicit job-level permissions (typically actions: read, contents: read, packages: read, pull-requests: read, and id-token: write where present). secrets: inherit preserved with zizmor ignore comments.
Labeler and Action Pinning \.github/workflows/labeler.yml, \.github/workflows/pr.yaml	Replaced floating action refs with pinned commit SHA for actions/labeler and pinned nv-gha-runners/get-pr-info (from @main to a specific SHA); annotated on: triggers to suppress zizmor warnings.
Project Permission \.github/workflows/new-issues-to-triage-projects.yml	assign_one_project job now declares repository-projects: write to permit updating repository project boards.
Zizmor Integration & Pre-commit \.github/zizmor.yml, \.pre-commit-config.yaml	Adds .github/zizmor.yml with unpinned-uses policy (allowlisting rapidsai/shared-* and enforcing hash-pin elsewhere) and registers the zizmor pre-commit hook at v1.24.1.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• fix check-nightly-ci job #2261 — Modifies the same CI job (check-nightly-ci / get-pr-info usage) and adds explicit job-level permissions, closely related to the workflow permission and action-pinning changes here.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix(ci): resolve all zizmor findings and add zizmor pre-commit checks' clearly summarizes the main changes: resolving zizmor security findings and adding zizmor pre-commit validation.
Description check	✅ Passed	The description directly relates to the changeset by explaining that it cleans up and annotates workflows and adds zizmor linting, matching the comprehensive workflow updates across multiple files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Review rate limit: 8/10 reviews remaining, refill in 8 minutes and 9 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/zizmor.yml:
- Around line 4-9: The repo-wide ref-pin policy still leaves floating refs in
workflows; address the two offending action refs (actions/labeler@v5 and
nv-gha-runners/get-pr-info@main) by either SHA-pinning those workflow uses to
their corresponding commit SHAs or explicitly exempting them in the zizmor
policies block (add entries like "actions/labeler@v5": any and
"nv-gha-runners/get-pr-info@main": any) so the overall "*": ref-pin policy no
longer fails.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 48620777-67a8-42da-a2e9-d1d8126c50b3

📥 Commits

Reviewing files that changed from the base of the PR and between 47910f9 and cbfbb31.

📒 Files selected for processing (8)

• .github/workflows/build.yaml
• .github/workflows/labeler.yml
• .github/workflows/new-issues-to-triage-projects.yml
• .github/workflows/pr.yaml
• .github/workflows/test.yaml
• .github/workflows/trigger-breaking-change-alert.yaml
• .github/zizmor.yml
• .pre-commit-config.yaml

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/pr.yaml (1)

60-63: ⚠️ Potential issue | 🔴 Critical

Add pull-requests: read and contents: read to check-nightly-ci job permissions.

The get-pr-info action (line 72) calls the GitHub REST API to fetch pull request details, which requires both pull-requests: read and contents: read permissions. Without these, the action will fail with a 403 error when attempting to read the PR metadata (line 77). The global permissions: {} at line 9 removes default scopes, so these must be explicitly declared at the job level.

Required permission adjustment

 check-nightly-ci:
   runs-on: ubuntu-latest
   permissions:
     actions: read
+    contents: read
     id-token: write
+    pull-requests: read

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/pr.yaml around lines 60 - 63, The check-nightly-ci job's
permissions block currently only grants actions: read and id-token: write;
update that permissions map to also include pull-requests: read and contents:
read so the get-pr-info action can call the REST API without 403s—modify the
permissions object in the check-nightly-ci job (the permissions: ... block
surrounding actions/id-token) to add pull-requests: read and contents: read.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In @.github/workflows/pr.yaml:
- Around line 60-63: The check-nightly-ci job's permissions block currently only
grants actions: read and id-token: write; update that permissions map to also
include pull-requests: read and contents: read so the get-pr-info action can
call the REST API without 403s—modify the permissions object in the
check-nightly-ci job (the permissions: ... block surrounding actions/id-token)
to add pull-requests: read and contents: read.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d1410a7d-2aab-4abb-8657-7c67061d9436

📥 Commits

Reviewing files that changed from the base of the PR and between 9adfa4e and 34902a6.

📒 Files selected for processing (3)

• .github/workflows/labeler.yml
• .github/workflows/pr.yaml
• .github/zizmor.yml

✅ Files skipped from review due to trivial changes (1)

• .github/zizmor.yml

[gforsyth]

/merge