Harden GitHub Actions with zizmor

zizmor is a static analyzer for GitHub Actions workflows. New workflow files — especially ones pasted from templates or generated by an app — almost always ship with insecure defaults (unpinned actions, no permissions boundary, credential persistence). If the repo runs zizmor in CI, those defaults fail the pipeline; even if it doesn't, they're real supply-chain and token-leak risks. So treat the audit as part of writing the workflow, not a separate review step that happens later.

When this applies

Run the audit whenever you have:

• Added a new file under .github/workflows/.
• Pasted or generated a workflow from a template (Claude GitHub App, an action's README, a scaffolding tool).
• Edited an existing workflow's uses:, permissions:, on:, or concurrency:.