ci: add zizmor

.github/workflows/ci.yml

@@ -471,7 +471,7 @@ jobs:
         with:
           python-version: "3.14"
           enable-cache: false
-      - run: uv tool run --exclude-newer '3 days' --no-cache prek run --all-files --show-diff-on-failure
+      - run: uvx --no-cache prek run --all-files --show-diff-on-failure
   rustfmt:
     runs-on: ubuntu-24.04
     steps:

.pre-commit-config.yaml

@@ -27,3 +27,7 @@ repos:
     rev: v3.8.3
     hooks:
       - id: prettier
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.25.2
+    hooks:
+      - id: zizmor

zizmor.yaml

@@ -0,0 +1,7 @@
+rules:
+  anonymous-definition:
+    disable: true
+  template-injection:
+    disable: true
+  undocumented-permissions:
+    disable: true