[ci] zizmor: security-lint GitHub Actions workflows (high-severity gate)

[trilamsr]

What this PR does

Wires zizmor into make ci
as a security-lint gate over .github/workflows/. Gates at
--min-severity=high — the dangerous classes (template injection,
untrusted input in run-blocks, over-broad permissions) — with
lower-confidence findings tracked in FOLLOWUPS for incremental
hardening.

Audit + findings (39 total in v1.25.2 dry-run)

Severity	Audit	Count	Action
High	template-injection	1	Fixed inline (release.yml:45)
High	cache-poisoning	2	Ignored inline via # zizmor: ignore[cache-poisoning] comments with rationale
Medium	ref-version-mismatch	1	Deferred to FOLLOWUPS
Low	artipacked	18	Deferred to FOLLOWUPS
Informational	template-injection	1	Deferred to FOLLOWUPS

The one dangerous finding (fixed)

release.yml:45 had tag="${{ inputs.tag }}" — textbook
template-injection: GitHub interpolates ${{ }} into the shell
command BEFORE the shell sees it, bypassing shell quoting entirely.
Reworked to pass via env var so the shell quotes the value itself.
zizmor audit-confidence: High; the only finding this PR fixes inline.

Accept-the-risk ignores

Two actions/setup-go@... with: cache: true cache-poisoning warnings
in release.yml (verify + build jobs). Both ignored with rationale
via inline # zizmor: ignore[cache-poisoning] comments on the
cache: true line — inline ignores move with the surrounding code,
so future edits to the workflow don't reactivate the warning at a
shifted line number. .github/zizmor.yml carries project-wide config
only.

Rationale: both are zizmor-confidence-Low; the cache is keyed on
go.sum which is the same trust root the M3 reproducible-rebuild +
cosign + SLSA provenance chain already validates. Reverting
cache: true adds ~30s per release with no integrity improvement.

Deferred (separate FOLLOWUPS row)

The 18 low + 1 medium + 1 info findings are defensive hardening, not
blockers. Cleanest path: lift the gate to --min-severity=medium
then low one tier at a time in focused PRs. Trigger: when the M21
supply-chain audit asks for it OR when external contributor onboarding
raises an Actions-security concern.

Install + invocation

• Local (macOS): brew install zizmor (1.25.2)
• Local (Linux): pip install zizmor==1.25.2
• CI: pinned to v1.25.2 via pip install --user; $HOME/.local/bin appended to $GITHUB_PATH after install so the next step finds the binary
• Invocation: scripts/zizmor.sh pins --config .github/zizmor.yml --min-severity=high --no-progress

Closes the FOLLOWUPS "CI Actions linters" row. Both halves now landed
— actionlint via #62, zizmor via this PR.

Linked issue(s)

No linked issue.

Release notes

[SECURITY] All GitHub Actions workflows are now security-linted by zizmor in CI; the dry-run surfaced one real template-injection in release.yml's tag-resolution step, fixed inline.

Checklist

• make zizmor exit 0 (22 ignored, 16 suppressed, 0 high findings)
• make ci exit 0 end-to-end (rebased onto post-[ci] actionlint: wire as a make ci gate via the go.mod tool stanza #62 main; both actionlint + zizmor in the chain)
• CI verify job exercised the install step end-to-end (green)
• Inline ignores survive line-shift (verified by swap from line-pinned .github/zizmor.yml entries)
• CHANGELOG ## [Unreleased] > ### Security entry added
• Commits are signed off
• One real injection vector fixed inline; lower-confidence findings documented and deferred with a triage path

Test plan

• Dry-run: 39 total findings → after fix + ignores, 0 high
• CI green on this PR (verify, build, Analyze, CodeQL, pr-lint all pass)
• After merge: a future PR that introduces ${{ ... }} directly in a run: block (or other high-severity zizmor audit class) fails CI

🤖 Generated with Claude Code