EVAL: zizmor for workflow-security analysis, a class no meta-check covers #237

The meta-checks cover workflow syntax (actionlint, sha-verified download at
ci.yml:4829-4840), shell bugs (shellcheck), SHA-pinning, and a fetch-exec guard. None of
them does injection or taint analysis on the workflows themselves.

zizmor (github.com/zizmorcore/zizmor, read 2026-08-30) is an MIT-licensed local CLI —
6.4k stars, adopted by CPython, cURL, PyPI, Rust and Sigstore — auditing GitHub Actions
for template injection, accidental credential persistence and leakage, excessive
permission scopes granted to runners, and impostor commits / confusable git references.

Against the house bar it is unusually clean: MIT, runs locally, no account, no SaaS in the
merge path, works identically on a private repo, and gates by exit code. It has no
asymmetry problem at all.

The honest caveat, measured before filing. This repo's exposure to the headline audit
looks small: .github/workflows/ci.yml has 186 run: blocks but only two github.*
interpolations reach a run context (github.workflow, github.ref), both benign. So the
eval should not be sold on template injection. The classes more likely to pay here are
over-broad permissions: and credential persistence, across seven workflows —
including release-tag.yml, which moves v1 for every consumer pinning @v1, and is the
one file where a workflow-security finding would matter most.

Acceptance: an EVAL-vs-zizmor.md recording the finding count per audit class across
all workflows in .github/workflows/, how many are true positives a maintainer would act
on, and the runtime. Adopt only if it finds something the existing meta-checks do not, on
this repo's real workflows — a clean run is a legitimate and publishable result, and would
close the question rather than leave it open.

Surfaced by the completeness critic of the 2026-08-30 market survey, which the six search
angles had missed entirely; licence, scope and star count verified directly.