Add zizmor GitHub Actions security scan to CI

[danbarr]

Description

Ran zizmor (a GitHub Actions security auditor) against this repo's workflows and fixed what it found:

• A template-injection risk in autogen-docs-notify.yml, where a workflow input was interpolated directly into a shell script instead of passed through env.
• Several checkouts that don't push commits afterward now set persist-credentials: false, including a new passthrough input on the shared ./.github/actions/setup composite action.
• The two checkouts that do need to keep credentials (because a later step pushes with them), and the workflow_run trigger in autogen-docs-notify.yml (deliberate and already documented in that file's security-model comment), are suppressed with inline zizmor: ignore comments explaining why.

Also adds a zizmor.yaml workflow that runs zizmor on every push to main and every PR, mirroring the setup already used in stacklok/infra, so future workflow changes get flagged automatically instead of relying on someone running it locally.

Type of change

Other (internal)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-website	Ready	Preview	Aug 10, 2026 6:23pm

[Copilot]

Pull request overview

Adds automated GitHub Actions security auditing to this docs site’s CI via zizmor, and hardens existing workflows/composite actions based on zizmor findings (credential persistence and template-injection).

Changes:

• Introduce a zizmor workflow to scan .github/workflows/ on PRs and pushes to main.
• Reduce credential persistence in workflows/composite action checkouts where no git push occurs.
• Harden autogen-docs-notify.yml by moving workflow-provided values into env before shell use, and document/suppress deliberate workflow_run usage.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/zizmor.yaml	New CI job to run zizmor against repository workflows.
.github/workflows/upstream-release-docs.yml	Adds inline zizmor suppressions and documents checkouts that intentionally retain credentials for git push.
.github/workflows/claude.yml	Disables credential persistence on checkout and via the shared setup composite.
.github/workflows/autogen-docs-notify.yml	Documents deliberate workflow_run trigger and removes template-injection risk by using env.
.github/workflows/_static-checks.yaml	Disables credential persistence on checkout and via the shared setup composite.
.github/actions/setup/action.yaml	Adds a persist-credentials passthrough input for actions/checkout in the shared setup action.

Suppressed comments (1)

.github/workflows/upstream-release-docs.yml:301

• This checkout is documented as requiring persisted credentials, but it relies on actions/checkout's default instead of setting it explicitly. Adding persist-credentials: true makes the intent match the comment and avoids surprises if defaults change.

      - name: Checkout PR branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: # zizmor: ignore[artipacked]
          ref: ${{ steps.eff.outputs.head_ref }}
          fetch-depth: 0

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.