ci(zizmor): pin the zizmor binary version (stop ruleset drift)

[gwarf]

Forward-port of EUDCH/.github#7 so both org reusable zizmor workflows match.

Problem

The reusable workflow SHA-pins zizmor-action but leaves the zizmor binary at the action default version: latest. So zizmor's ruleset and online-audit set drift independently of the pin, and a new or strengthened audit can flip CI red across every caller with no repo change. (On the EUDCH side this actually happened — a ref-version-mismatch finding surfaced on unchanged workflows.)

Fix

Pin the binary: version: "1.26.1" on the zizmor-action step. New audits now arrive only on a deliberate bump of this value, reviewable here.

Notes

• Functionally identical to the merged ci(zizmor): pin the zizmor binary version (stop ruleset drift) EUDCH/.github#7 (only the org-name header comment differs).
• Fork-PR handling / advanced-security / annotations logic unchanged.
• actionlint clean; callers re-pin @<sha> to adopt, as usual.

[Copilot]

Pull request overview

Pins the zizmor binary version used by the reusable zizmor workflow so that zizmor’s ruleset/online-audit behavior doesn’t drift independently of the SHA-pinned zizmorcore/zizmor-action, preventing unexpected CI failures across downstream callers.

Changes:

• Add an explicit version: "1.26.1" input to the zizmorcore/zizmor-action step.
• Document why the binary version is pinned and that it should be bumped deliberately.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gwarf]

_MREVIEW — Automated Review

Platform: GitHub | Ref: #4 | CI: none reported (normal — reusable-workflow repo, exercised by callers)
Rules applied: global

Verdict: LGTM — correct forward-port of the merged EUDCH/.github#7. Ready to merge.

I reviewed and validated the identical change on EUDCH/.github#7 already, so this is a confirm-it-matches pass:

• Diff is functionally identical to #7: adds version: "1.26.1" (+ the same explanatory comment) to the with: block of the zizmorcore/zizmor-action@192e21d… # v0.5.7 step — and I confirmed that action step is SHA-pinned here exactly as on the EUDCH side. Same action SHA, same structure; only the org-name header comment differs, as the description says.
• Same correct rationale: the action defaults the binary to latest, so the ruleset/online-audit set drifts independently of the SHA pin — which is what flipped CI red across callers on the EUDCH side. Pinning the binary makes new audits a deliberate, reviewable bump. Enforce gate / fork-PR handling unchanged.
• Copilot left only its overview summary — no actionable findings.

Carried-over non-blocking notes (same as #7, accepted there): pinning the binary means new zizmor audits no longer arrive automatically — worth wiring version: into Renovate so it doesn't go stale; and sanity-check 1.26.1 is the intended current release. Neither blocks merge. Callers then re-pin @<sha> to adopt, as usual.

---

Posted by _MREVIEW v1.0 on 2026-06-29 CEST