add zizmor justfile and security dependency group

- .just/zizmor.justfile: run/fix/sarif/version recipes for zizmor,
  matching the pedantic persona used by .github/workflows/zizmor.yaml
- pyproject.toml: add active "security" dependency group (zizmor)
  and include it (plus "packaging") in the dev group
- uv.lock: regenerated, dropping stale bandit/safety lock entries
  left over from their earlier removal and adding zizmor

Author: woutervh

.just/zizmor.justfile

@@ -0,0 +1,36 @@
+# zizmor - lints Github Actions workflows for security issues, see ../justfile
+# docs: https://docs.zizmor.sh/
+
+
+# show which zizmor is used
+[group: 'zizmor']
+zizmor-which:
+    @ echo -e "Using uv run zizmor"
+
+
+# run zizmor on the github workflows (pedantic persona, same as CI)
+[group: 'zizmor']
+zizmor *args:
+    uv run zizmor --persona pedantic .github/workflows {{args}}
+
+alias zizmor-check := zizmor
+
+
+# run zizmor and apply safe auto-fixes
+[group: 'zizmor']
+zizmor-fix *args:
+    uv run zizmor --persona pedantic --fix=safe .github/workflows {{args}}
+
+
+# run zizmor with sarif output
+[group: 'zizmor']
+zizmor-sarif:
+    @ mkdir -p var/zizmor
+    @ echo -e "Zizmor SARIF report generated in var/zizmor/results.sarif.json"
+    uv run zizmor --persona pedantic --format sarif .github/workflows > var/zizmor/results.sarif.json
+
+
+# display zizmor version
+[group: 'zizmor']
+zizmor-version:
+    uv run zizmor --version

justfile

@@ -57,6 +57,7 @@ import? '.just/sshx.justfile'
 import? '.just/ty.justfile'
 import? '.just/ubuntu.justfile'
 import? '.just/uv.justfile'
+import? '.just/zizmor.justfile'
 
 
 # Display all configure tasks (default recipe)

pyproject.toml

@@ -55,7 +55,9 @@ dependencies = [
 dev = [
     { include-group = "ipython" },
     { include-group = "linting" },
+    { include-group = "packaging" },
     { include-group = "pre-commit" },
+    { include-group = "security" },
     { include-group = "testing" },
     { include-group = "typing" },
     "toml-cli >=0.7.0",
@@ -89,10 +91,11 @@ pre-commit = [
     "pre-commit-hooks>=5.0",
     "prek>=0.2",
 ]
-# security = [
-#     "bandit[toml]>=1.7",
-#     "safety>=2.3",
-# ]
+security = [
+    # "bandit[toml]>=1.7",
+    # "safety>=2.3",
+    "zizmor>=1.0",
+]
 testing = [
     "pytest>=8.3",
     "pytest-clarity>=1.0",