Lint remaining GHA workflows

We don't really have any credentials in CI, the main thing is that the client and workstation repos have push tokens for apt-test/yum-test/build-logs (the last one is probably the most sensitive).

https://woodruffw.github.io/zizmor/ is one I had seen previously on lobsters and now it's mentioned on https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/ so we should give it a shot.

It's written in Rust and the recommendation is to cargo install it, so we can do something like https://github.com/freedomofpress/securedrop/blob/develop/.github/workflows/cargo-vet.yml

Primary repositories

• securedrop-client: https://github.com/freedomofpress/securedrop-client/pull/2331
• securedrop-workstation: https://github.com/freedomofpress/securedrop-workstation/pull/1222
• securedrop: https://github.com/freedomofpress/securedrop/pull/7401
• securedrop-builder: https://github.com/freedomofpress/securedrop-builder/pull/507
• securedrop-https-everywhere-ruleset: https://github.com/freedomofpress/securedrop-https-everywhere-ruleset/pull/215

Docs repos

• securedrop-dev-docs
• securedrop-docs
• securedrop-workstation-docs

Package repositories

n.b. these don't have a Python toolchain setup

• securedrop-yum-test
• securedrop-yum-prod
• securedrop-apt-test
• securedrop-apt-prod

Misc

• kernel-builder
• securedrop-supply-chain

Review the unchecked repositories' GitHub Actions workflows, using the linked securedrop .github/workflows/cargo-vet.yml example as a starting point. Try zizmor against the workflows in securedrop-dev-docs, securedrop-docs, securedrop-workstation-docs, the package repositories, kernel-builder, and securedrop-supply-chain. Done means the remaining workflows are linted and any findings are addressed or documented.