Add zizmor GitHub Actions static analysis (#78)

* Add zizmor GitHub Actions static analysis

Also applies zizmor --fix=all to existing workflows: pins previously
unpinned/mutable action refs to commit SHAs and adds persist-credentials:
false to checkout steps, clearing every pre-existing high-severity finding.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(ci): add back pull_request trigger for zizmor workflow, scope push to master

Bot reviewers (Copilot, Sentry) correctly flagged that a push-only trigger
misses fork-based PRs and can't act as a required merge-gate status check.
Scoping push to the default branch avoids the original double-run problem
(push firing on every commit to a same-repo PR branch, redundant with
pull_request) while restoring PR-gate coverage.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(ci): lower zizmor gate to min-severity=medium, fix resulting findings

- ci.yml: add `permissions: contents: read` to javascript-tests job
  (checkout, yarn install, lint, test, rollup build only, no writes needed)
- actions-static-analysis.yml: lower zizmor gate from min-severity=high to
  min-severity=medium now that the excessive-permissions finding above is
  fixed

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: blarghmatey

.github/workflows/actions-static-analysis.yml

@@ -0,0 +1,34 @@
+name: GitHub Actions Static Analysis
+
+on:
+  push:
+    branches:
+      - "master"
+    paths:
+      - ".github/workflows/**"
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          inputs: ".github/workflows/"
+          min-severity: medium
+          min-confidence: medium
+          advanced-security: false

.github/workflows/ci.yml

@@ -3,11 +3,15 @@ on: [push]
 jobs:
   javascript-tests:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+        with:
+          persist-credentials: false
 
       - name: Set up NodeJS
-        uses: actions/setup-node@v2-beta
+        uses: actions/setup-node@27082cecf3ff7a1742dbd5e12605f0cb59dce2d9 # v2.1.3 (resolved from v2-beta tag)
         with:
           node-version: 16.20.2