ci: run zizmor in CI and noxfile

- Adds lockfile
- Adds nox session
- Adds nox session to CI matrix

Author: gotmax23

.github/workflows/reusable-nox.yml

@@ -34,6 +34,8 @@ jobs:
           - session: "pip-compile"
             extra-args: "--check"
             python-versions: "3.12"
+          - session: "zizmor"
+            python-versions: "3.12"
     name: "Run nox ${{ matrix.session }} session"
     steps:
       - name: Check out repo

noxfile.py

@@ -140,6 +140,15 @@ def actionlint(session: nox.Session) -> None:
     )
 
 
+@nox.session
+def zizmor(session: nox.Session) -> None:
+    """
+    Ren zizmor, a Github Actions security checker
+    """
+    install(session, req="zizmor")
+    session.run("zizmor", "--persona=regular", ".github/workflows")
+
+
 @nox.session
 def lint(session: nox.Session):
     session.notify("typing")

tests/zizmor.in

@@ -0,0 +1 @@
+zizmor

tests/zizmor.txt

@@ -0,0 +1,4 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile --universal --output-file tests/zizmor.txt tests/zizmor.in
+zizmor==1.16.0
+    # via -r tests/zizmor.in