Run Zizmor on all generated workflows in CI

[Copilot]

gh-aw generates GitHub Actions workflows, but CI only scanned a single workflow (poem-bot) with Zizmor, and only on main. This lets Zizmor findings ship in the generated .lock.yml files, blocking gh-aw CLI upgrades for downstream projects (e.g. Argo CD) that run Zizmor on their own CI.

Changes

• New zizmor job in .github/workflows/cgo.yml — depends on build, restores the checkout cache, downloads the already-built gh-aw-linux-amd64 artifact (no rebuild), and runs ./gh-aw compile --zizmor --verbose to scan all repository workflows on every CI event.
• Wired into notify-failure so failures surface through the existing aggregation.

  zizmor:
    needs: [build]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - name: Restore checkout
      uses: actions/cache/restore@...
      with: { path: ., key: checkout-${{ github.sha }}, fail-on-cache-miss: true }
    - name: Download gh-aw binary
      uses: actions/download-artifact@...
      with: { name: gh-aw-linux-amd64 }
    - name: Make gh-aw executable
      run: chmod +x gh-aw
    - name: Run zizmor security scan on all workflows
      run: ./gh-aw compile --zizmor --verbose
      env: { GH_TOKEN: ${{ github.token }} }

Unlike the pre-existing security-scan matrix (main-only, single workflow), this job covers every generated workflow on all events, catching findings before release.

• Fixes Having Zizmor run as part of the CI #50537

[pelikhan]

needs validate-yaml

[pelikhan]

@copilot update to needsvalidate.yaml.

[Copilot]

Updated the zizmor job to needs: [build, validate-yaml] in 27bbacd's follow-up commit.

[Copilot]

Pull request overview

Adds a CI job intended to scan all generated workflows with Zizmor using the existing build artifact.

Changes:

• Adds the zizmor job.
• Connects it to failure notification aggregation.

Show a summary per file

File	Description
.github/workflows/cgo.yml	Adds and wires the Zizmor CI scan.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 3
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.85.4