Summary

v0.x counterpart to #10618 and #10627. Adds zizmor and hardens the existing CI workflow, matching the v1.x setup.

run-ci-v0.yml: SHA-pins all actions and sets persist-credentials: false (was true). SHAs can be verified with pinact or zizmor.

zizmor.yml: new workflow, copied from v1.x. Runs on pushes to v0.x and on PRs, uploads SARIF to code scanning.

Summary by cubic

Adds zizmor security scanning and hardens v0.x CI by pinning actions and disabling credential persistence. Aligns the v0.x pipeline with v1.x to improve supply-chain security.

• Description

  • Added .github/workflows/zizmor.yml to scan GitHub Actions on pushes to v0.x and all PRs; uploads SARIF to code scanning. Uses top-level permissions: {} and grants security-events: write only.
  • Hardened .github/workflows/run-ci-v0.yml: SHA-pinned actions/checkout, actions/setup-node, and actions/dependency-review-action; set persist-credentials: false.
  • Synced with the latest v0.x to keep CI config in step.

• Testing

  • CI-only changes; validated via workflow runs.
  • Pins can be verified with pinact or zizmor; no additional tests needed.

^{Written for commit f9e132b. Summary will update on new commits.}