[ci] add zizmor to CI

[taobojlen]

What

This is an equivalent to this PR in Coop. It introduces zizmor, a very neat static analysis tool for GitHub Actions.

This PR:

• fixes all the findings from zizmor in our current actions, hardening their security, and
• adds a zizmor CI workflow so that we don't accidentally introduce weaknesses in our Actions in the future.

Testing

Mostly, you should see CI pass!

There are some workflows I can't test with the changes, like release-osprey-rpc.yml. We'll have to keep an eye on those the next time they run. (But I don't believe my changes will cause issues).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added automated security scanning to identify potential vulnerabilities in code.

• Chores

  • Enhanced CI/CD pipeline security by implementing stricter permission controls.
  • Added cooldown periods for dependency updates to reduce update frequency.
  • Improved release process reliability and credential handling across workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d019ad1-917b-42be-914d-b67e81e5eb14

📥 Commits

Reviewing files that changed from the base of the PR and between 219528a and 45e54a4.

📒 Files selected for processing (7)

• .github/dependabot.yml
• .github/workflows/code-quality.yml
• .github/workflows/integration-tests.yml
• .github/workflows/mdbook.yml
• .github/workflows/publish-coordinator-image.yml
• .github/workflows/release-osprey-rpc.yml
• .github/workflows/zizmor.yml

---

📝 Walkthrough

Walkthrough

This PR hardens the CI/CD security posture by adding a new zizmor static analysis workflow, applying contents: read permissions and persist-credentials: false across all existing workflows, scoping write permissions to only the jobs that need them, replacing the softprops/action-gh-release action with a gh release upload CLI invocation, and adding 7-day cooldown intervals to Dependabot ecosystem entries.

Changes

CI Security Hardening

Layer / File(s)	Summary
New zizmor security scan workflow .github/workflows/zizmor.yml	Introduces a workflow that runs zizmor on pushes to main and all PRs, with concurrency cancellation, least-privilege permissions (security-events: write), pinned action SHAs, and conditional SARIF upload vs. PR annotations.
Least-privilege permissions and credential hardening .github/workflows/code-quality.yml, .github/workflows/integration-tests.yml, .github/workflows/mdbook.yml	Adds top-level contents: read permissions blocks and persist-credentials: false to checkout steps; mdbook.yml moves pages: write and id-token: write down to the deploy job only.
Credential hardening and release upload refactor .github/workflows/publish-coordinator-image.yml, .github/workflows/release-osprey-rpc.yml	Adds persist-credentials: false to both workflows; refactors the coordinator image build summary step to use env vars; replaces softprops/action-gh-release with gh release upload CLI and disables uv caching in the release workflow.
Dependabot cooldown configuration .github/dependabot.yml	Adds cooldown: default-days: 7 to both the uv and github-actions ecosystem entries.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title '[ci] add zizmor to CI' directly references the primary change of adding the zizmor security analysis tool to the CI pipeline, which is the most significant addition in the PR. However, it does not capture the equally important security hardening fixes applied to existing workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch tao/lint-github-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[haileyok]

this lgtm, @juanmrad if you dont mind just peeking at this as well

[haileyok]

good catch

[taobojlen]

thank you zizmor 🙏

[taobojlen]

@juanmrad already reviewed my equivalent PR in Coop and made some good suggestions that are incorporated here. So I'm going to go ahead and merge, but please let me know if there's anything I can improve here!