ci: enable checks against workflow yaml

[reubeno]

Adopts zizmor for checking our workflow YAMLs.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull Request Overview

This PR integrates the zizmor tool to lint and enforce policies on GitHub workflow YAMLs.

• Introduces a zizmor.yml config to allow an exception for dtolnay/rust-toolchain.
• Adds a new workflow-checks.yaml workflow to run zizmor and upload SARIF results.
• Updates existing workflows (ci.yaml and ci-reports.yaml) to suppress specific zizmor checks.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
zizmor.yml	Define unpinned-uses rule with policy exception for Rust toolchain
.github/workflows/workflow-checks.yaml	New workflow for running zizmor and uploading SARIF output
.github/workflows/ci.yaml	Add inline ignore for stale-action-refs on Homebrew action
.github/workflows/ci-reports.yaml	Add inline ignore for dangerous-triggers on PR reports workflow

Comments suppressed due to low confidence (1)

.github/workflows/workflow-checks.yaml:29

• The comment says 'Install the latest version of uv' but the action is pinned to v6.0.1; consider updating the comment to reflect the pinned version or remove 'latest'.

-      - name: Install the latest version of uv

[Copilot]

There's a typo in this comment ('an intentional'); it should read 'and intentional' or be combined into a clearer single sentence.

Suggested change

	# We intentionally run this workflow in the context of the target of a PR; we are careful
	# an intentional about how we handle the data coming from the PR.
	# We intentionally run this workflow in the context of the target of a PR, and we are careful
	# about how we handle the data coming from the PR.

[github-actions]

Test Results

    3 files     17 suites   3m 39s ⏱️
  771 tests   771 ✅ 0 💤 0 ❌
2 299 runs  2 299 ✅ 0 💤 0 ❌

Results for commit a1ff35d.

[github-actions]

Performance Benchmark Report

Benchmark name	Baseline (μs)	Test/PR (μs)	Delta (μs)	Delta %
clone_shell_object	18.25 μs	18.16 μs	-0.09 μs	⚪ Unchanged
eval_arithmetic	0.17 μs	0.17 μs	0.00 μs	⚪ Unchanged
expand_one_string	1.91 μs	1.82 μs	-0.10 μs	⚪ Unchanged
for_loop	23.06 μs	23.18 μs	0.11 μs	⚪ Unchanged
function_call	2.68 μs	2.40 μs	-0.28 μs	⚪ Unchanged
instantiate_shell	56.73 μs	57.36 μs	0.62 μs	⚪ Unchanged
instantiate_shell_with_init_scripts	25971.48 μs	26432.21 μs	460.72 μs	⚪ Unchanged
parse_bash_completion	1671.08 μs	1667.51 μs	-3.58 μs	⚪ Unchanged
parse_sample_script	1.80 μs	1.80 μs	-0.00 μs	⚪ Unchanged
run_echo_builtin_command	15.62 μs	15.53 μs	-0.08 μs	⚪ Unchanged
run_one_external_command	2308.33 μs	3250.94 μs	942.61 μs	🟠 +40.84%
tokenize_sample_script	2.98 μs	2.91 μs	-0.07 μs	🟢 -2.38%

Code Coverage Report: Only Changed Files listed

Package	Base Coverage	New Coverage	Difference
Overall Coverage	🟢 75.01%	🟢 75.01%	⚪ 0%

Minimum allowed coverage is 70%, this run produced 75.01%

Test Summary: bash-completion test suite

Outcome	Count	Percentage
✅ Pass	1299	61.59
❗️ Error	224	10.62
❌ Fail	194	9.20
⏩ Skip	377	17.88
❎ Expected Fail	15	0.71
📊 Total	2109	100.00