Create zizmor.yml

[andife]

What this PR does

This PR introduces zizmor, a static analysis tool for GitHub Actions workflows, and fixes the supply chain security issues it identifies across all existing workflow files.

New workflow: zizmor.yml

Adds a CI job that runs zizmor on every push to main and on every pull request. zizmor audits .github/workflows/ for common security misconfigurations including:

• Unpinned actions — version tags like @v4 are mutable; they can be silently updated or hijacked. zizmor requires every uses: reference to be pinned to an immutable SHA hash.
• Excessive permissions — workflows that request write permissions they do not need.
• Script injection risks — untrusted user input flowing into run: steps without sanitization.
• Credential leaks — credentials inadvertently persisted across steps.

Results are uploaded as SARIF to GitHub's Security tab so findings are surfaced directly alongside code review.

Why SHA pinning?

When a workflow references actions/checkout@v4, GitHub resolves the v4 tag at runtime. A compromised or mistakenly updated tag silently changes the code that executes in your CI environment — with access to secrets and the ability to modify build outputs. Pinning to a full 40-character commit SHA makes that reference immutable: the exact same code runs on every invocation, and any change to the referenced action is immediately visible in the diff.

The comment (# v4, # stable, etc.) preserved alongside each SHA makes it easy for humans to understand what version is pinned and for tools like Dependabot or zizmor to suggest upgrades.

Ecosystem alignment

This change reflects a broader shift in the ML ecosystem toward supply chain security as a baseline. As ONNX and projects like ml_dtypes evolve their dependencies and infrastructure, securing the CI/CD pipeline—starting with immutable action pinning and least-privilege permissions—becomes essential for maintainers and users alike.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[jakevdp]

Thanks

[jakevdp]

Thanks – could you please squash the changes into a single commit?