feat(web): add oxford views prompt management #30

	---
	name: Check GitHub Actions

	on:
	workflow_dispatch:
	push:
	branches:
	- "main"
	merge_group:
	pull_request:
	branches:
	- "main"

	permissions: {}

	jobs:
	zizmor:
	name: Check GitHub Actions security
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	contents: read
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Run zizmor (fork PR - fail on findings)
	# Fork PRs don't get security-events: write on GITHUB_TOKEN, so SARIF
	# upload isn't possible. Fail the job on findings instead so contributors
	# see the error directly in the PR check.
	if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
	uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

	- name: Run zizmor (trusted - upload SARIF)
	if: github.event_name != 'pull_request' \|\| github.event.pull_request.head.repo.full_name == github.repository
	uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
	with:
	# Means that the action will only report issues, but not fail the workflow.
	# Blocking merges are handled by rulesets:
	# https://docs.github.com/en/code-security/concepts/code-scanning/about-code-scanning-alerts#pull-request-check-failures-for-code-scanning-alerts
	advanced-security: true

Provide feedback