Add zizmor workflow (#617)

* Add `zizmor` workflow

* fix issues

* fix one thing

* add permission comments

* add job names

* move zizmor to CI

.github/workflows/ci.yml

@@ -2,9 +2,8 @@ name: CI
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
+  # merge queue is required so all commits on target branches trigger this workflow
+  # despite lack of the push event trigger here
   merge_group:
     branches:
       - main
@@ -12,7 +11,30 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.sha }}
+  cancel-in-progress: true
+
 jobs:
+  lint-workflows:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read # only required in private repos
+      security-events: write # allow writing security events
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          persona: pedantic
+          annotations: true
+          advanced-security: false
+
   test:
     name: Test
     timeout-minutes: 20
@@ -49,8 +71,8 @@ jobs:
     name: CI OK
     runs-on: ubuntu-latest
     if: always()
-    needs: [test, typecheck]
+    needs: [lint-workflows, test, typecheck]
     steps:
       - name: Exit with error if some jobs are not successful
         run: exit 1
-        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')) }}
+        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}