ci: add zizmor security lint

[robjtede]

Adds a pinned zizmor security-lint job to the existing lint workflow.

Also fixes the current audit findings: Dependabot cooldowns, checkout credential persistence, and a mutable reusable workflow reference.

Validation:

• zizmor v1.29.0 --offline /workspace — no findings to report.

Summary by CodeRabbit

• Security

  • Improved the security of automated build, test, coverage, and release workflows.
  • Added automated checks to identify potential workflow security issues.
  • Reduced the risk associated with mutable workflow references and persisted credentials.

• Chores

  • Added a short stabilization period before selected dependency updates are applied, helping reduce unexpected build or release disruptions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: df94b183-8249-471f-ada0-071eb97ee3c2

📥 Commits

Reviewing files that changed from the base of the PR and between aecf715 and 7b8c2a4.

📒 Files selected for processing (5)

• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/coverage.yml
• .github/workflows/lint.yml
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The changes add seven-day Dependabot cooldowns, pin a workflow action, disable persisted checkout credentials, and add a zizmor security scan to the lint workflow.

Changes

CI and dependency security hardening

Layer / File(s)	Summary
Dependency update cooldowns .github/dependabot.yml	Dependabot applies a seven-day cooldown to GitHub Actions, Nix, and Cargo updates.
Workflow action and credential controls .github/workflows/ci.yml, .github/workflows/coverage.yml, .github/workflows/release.yml	The MSRV action uses a pinned commit. Coverage and release checkout steps disable persisted credentials.
Workflow security scanning .github/workflows/lint.yml	The lint workflow runs the pinned zizmor-action with advanced security disabled and annotations enabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• x52dev/contracts#113: Modifies the same GitHub Actions workflows to harden CI security.
• x52dev/contracts#148: Modifies the same Dependabot configuration and update settings.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: adding a Zizmor security lint job to CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/add-zizmor-lint

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}