ci: add zizmor action

[tongpu]

Description

This PR introduces zizmor to scan the security of our GitHub Actions

Issues

n/a

Checklist

• This PR contains a description of the changes I'm making
• I updated the version in Chart.yaml
• I updated the changelog with an artifacthub.io/changes annotation in Chart.yaml, check the example in the documentation.
• I updated applicable README.md files using pre-commit run
• I documented any high-level concepts I'm introducing in docs/
• CI is currently green and this is ready for review
• I am ready to test changes after they are applied and released

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[hairmare]

Does this need some change to docs/?

[hairmare]

we might also want to consider adding this: https://github.com/zizmorcore/zizmor-pre-commit

[tongpu]

we might also want to consider adding this: https://github.com/zizmorcore/zizmor-pre-commit

Adding a pre-commit action would definitely make it more transparent, but then we would end up with both the zizmor pre-commit hook and the zizmor action in the pipeline.

Does this need some change to docs/?

We could use this as a starting point to improve the documentation of the actions we're using, because right now we don't explicitly documented any of them.

[hairmare]

We could use this as a starting point to improve the documentation of the actions we're using, because right now we don't explicitly documented any of them.

sounds like a plan, right now a lot of it is implicitly covered by us using pre-commit for linting and doxing the actions setup properly would for sure be beneficial

[hairmare]

I love the warning you added to .github/workflows/pr-sizing.yaml.

I think we should do some more stringent review of our usage of pull_request_target, it just doesn't feel like a it's false positive enough to ignore without further analysis. We have "Require approval for all external contributors" enabled on the repo, but zizmor makes me question if that is enough.

Do we want to do an "appsec" style review in this thread or would we prefer doing this in a new issue?

[tongpu]

It's definitely not a false positive, but I would assume that changing it to pull_request would require us to configure some credentials to allow the pr size action to add labels to PRs.

I'm fine with doing an appsec review in this PR, since my goal was to improve the security of this repository and I'd rather do this all in one swoop. We might want to split out the simple fixes from this PR into another one and focus on the introduction of zizmor in this one.

[tongpu]

While preparing #1424 I realized that the pr-sizing action is not even checking out the source code, but instead getting the number of changed lines from the files in the PR. But that doesn't actually change the security stance much, since anyone could introduce a change to the workflow that would be executed in the context of this repository.

[tongpu]

I've opened #1424 with the obvious changes to improve the security of our actions. We can choose to implement the changes in #1424 and continue with the integration of the action and improvements to the pr-sizing action in here.