chore(ci): run zizmor to harden GitHub Actions security

[Boshen]

Response to recent event: https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/

[netlify]

✅ Deploy Preview for rolldown-rs canceled.

Name	Link
🔨 Latest commit	fe88258
🔍 Latest deploy log	https://app.netlify.com/sites/rolldown-rs/deploys/67d5817fabe9c30009fea298

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[hyfdev]

@Boshen Would you able to give a concise sharing in Monday's meeting? I think everybody should at least have the hang of it.

[Boshen]

@Boshen Would you able to give a concise sharing in Monday's meeting? I think everybody should at least have the hang of it.

Sure. tldr https://woodruffw.github.io/zizmor/ is a static analysis tool, we'll have to manually fix the reported warnings.

[github-actions]

Benchmarks Rust

• target: main(397ef09)
• pr: zizmor(fe88258)

group                                                               pr                                     target
-----                                                               --                                     ------
bundle/bundle@multi-duplicated-top-level-symbol                     1.00     68.5±0.79ms        ? ?/sec    1.01     68.9±0.53ms        ? ?/sec
bundle/bundle@multi-duplicated-top-level-symbol-minify              1.00     90.5±1.00ms        ? ?/sec    1.00     90.5±0.94ms        ? ?/sec
bundle/bundle@multi-duplicated-top-level-symbol-minify-sourcemap    1.01    103.7±0.81ms        ? ?/sec    1.00    103.1±1.07ms        ? ?/sec
bundle/bundle@multi-duplicated-top-level-symbol-sourcemap           1.01     78.9±0.56ms        ? ?/sec    1.00     78.2±0.73ms        ? ?/sec
bundle/bundle@rome-ts                                               1.00    119.5±1.76ms        ? ?/sec    1.01    120.4±1.23ms        ? ?/sec
bundle/bundle@rome-ts-minify                                        1.00    195.5±1.60ms        ? ?/sec    1.00    195.1±1.79ms        ? ?/sec
bundle/bundle@rome-ts-minify-sourcemap                              1.00    230.2±1.86ms        ? ?/sec    1.00    229.2±1.33ms        ? ?/sec
bundle/bundle@rome-ts-sourcemap                                     1.00    133.4±7.19ms        ? ?/sec    1.00    133.2±2.51ms        ? ?/sec
bundle/bundle@threejs                                               1.01     41.2±2.20ms        ? ?/sec    1.00     40.7±0.36ms        ? ?/sec
bundle/bundle@threejs-minify                                        1.00     84.6±0.44ms        ? ?/sec    1.01     85.0±0.68ms        ? ?/sec
bundle/bundle@threejs-minify-sourcemap                              1.03    106.7±1.32ms        ? ?/sec    1.00    103.7±2.16ms        ? ?/sec
bundle/bundle@threejs-sourcemap                                     1.00     47.3±0.21ms        ? ?/sec    1.00     47.5±0.74ms        ? ?/sec
bundle/bundle@threejs10x                                            1.00    431.3±4.22ms        ? ?/sec    1.01    433.6±3.49ms        ? ?/sec
bundle/bundle@threejs10x-minify                                     1.00   1067.6±5.09ms        ? ?/sec    1.00   1072.5±6.84ms        ? ?/sec
bundle/bundle@threejs10x-minify-sourcemap                           1.00   1244.8±5.52ms        ? ?/sec    1.00   1246.5±6.88ms        ? ?/sec
bundle/bundle@threejs10x-sourcemap                                  1.00    496.0±3.20ms        ? ?/sec    1.01    499.5±2.45ms        ? ?/sec
remapping/remapping                                                 1.04     26.9±0.34ms        ? ?/sec    1.00     25.9±0.67ms        ? ?/sec
remapping/render-chunk-remapping                                    1.00     63.5±1.09ms        ? ?/sec    1.00     63.4±0.22ms        ? ?/sec
scan/scan@rome-ts                                                   1.00     93.8±1.21ms        ? ?/sec    1.00     94.2±1.20ms        ? ?/sec
scan/scan@threejs                                                   1.00     31.2±1.10ms        ? ?/sec    1.00     31.1±0.25ms        ? ?/sec
scan/scan@threejs10x                                                1.00    315.7±4.92ms        ? ?/sec    1.00    316.3±3.29ms        ? ?/sec