Add zizmor linter

Author: benmoss

lefthook.yaml

@@ -56,6 +56,9 @@ pre-commit:
     - name: typos
       stage_fixed: true
       run: pixi {run} typos
+    - name: zizmor
+      glob: ".github/*.{yaml,yml}"
+      run: pixi {run} zizmor {staged_files}
 
 pre-push:
   jobs:

pixi.lock

@@ -138,6 +138,7 @@ ruff = ">=0.14.0,<0.15"
 shellcheck = ">=0.10.0,<0.11"
 taplo = ">=0.10.0,<0.11"
 typos = ">=1.38.1,<2"
+zizmor = ">=1.14.1,<2"
 
 [feature.lint.tasks]
 actionlint = { cmd = "actionlint", env = { SHELLCHECK_OPTS = "-e SC2086" } }

pixi.toml

@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        prefix-dev/*: any