chore(ci): harden zizmor install shell

Author: ben-challis

.github/workflows/ci.yml

@@ -46,10 +46,12 @@ jobs:
           show-progress: false
 
       - name: "Install zizmor"
+        shell: bash
         env:
           ZIZMOR_SHA256: "dd96df044a6e8538d5f423790f453bdd03d49e5b2bcc38214acc41a2f1297839"
           ZIZMOR_VERSION: "1.29.0"
         run: |
+          set -euo pipefail
           archive="$RUNNER_TEMP/zizmor.tar.gz"
           curl --proto '=https' --tlsv1.2 -fsSL "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" -o "$archive"
           echo "${ZIZMOR_SHA256}  ${archive}" | sha256sum --check