Audit GHA workflows with zizmor

[maresb]

Description

This should reduce the chance that we do something dangerous with GHA that might lead to a compromise of the repo.

Mirrors pymc-devs/pytensor#1136

Checklist

• Checked that the pre-commit linting/style checks pass
• Included tests that prove the fix is effective or that the new feature works
• Added necessary documentation (docstrings and/or example notebooks)
• If you are a pro: each commit corresponds to a relevant logical change

Type of change

• New feature / enhancement
• Bug fix
• Documentation
• Maintenance
• Other (please specify):

---

📚 Documentation preview 📚: https://pymc--7624.org.readthedocs.build/en/7624/

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[maresb]

CC also @wd60622 regarding 93681ed

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.83%. Comparing base (5d51953) to head (1120951).
Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7624      +/-   ##
==========================================
- Coverage   92.83%   92.83%   -0.01%     
==========================================
  Files         106      106              
  Lines       17748    17748              
==========================================
- Hits        16477    16476       -1     
- Misses       1271     1272       +1     

see 1 file with indirect coverage changes

[lucianopaz]

I see that the workflow was copied from the zizmor docs so that one is fine. Were the other changes things that zizmor suggested to do to remove security vulnerabilities? Anyway, this looks ok to me, even though I know nothing of security vulnerabilities in GHA.

[maresb]

I see that the workflow was copied from the zizmor docs so that one is fine. Were the other changes things that zizmor suggested to do to remove security vulnerabilities? Anyway, this looks ok to me, even though I know nothing of security vulnerabilities in GHA.

Excellent question! Thanks for checking this so thoroughly. For the discrepancies, I'm following hynek, the author of structlog. Here's his workflow. I just tried to pick the best from both. For anyone from the future looking back on this, the differences are not substantial, so there should be no barrier to using the pure zizmor workflow.