💚 ci: add zizmor

.github/workflows/zizmor.yml

@@ -0,0 +1,28 @@
+name: zizmor GitHub Actions Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "15 6 * * 1" # weekly Monday 06:15 UTC
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read # Only needed for private repos. Needed to clone the repo.
+      actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

CONTRIBUTING.md

@@ -15,13 +15,13 @@ or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any addi
 
 ## :space_invader: Codespaces
 
-We provide a configured devcontainer for you to use in your new project and/or msr-cookie-doh itself.
+We provide a configured devcontainer for you to use in your new project and/or cookie-doh itself.
 You can create a container image with all the necessary dependencies,
 and use it for remote development in a remote node with [GitHub Codespaces](https://docs.github.com/en/codespaces).
 
 :point_right: Click below to clone or fork this repository automatically and start developing:
 
-[![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/msr-cambridge-uk/msr-cookie-doh)
+[![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/microsoft/cookie-doh)
 
 ## :gear: Devcontainer
 

bin/check-all

@@ -19,6 +19,10 @@ echo
 echo "RUNNING CODESPELL"
 uv run codespell
 
+echo
+echo "RUNNING ZIZMOR"
+uv run zizmor .
+
 echo
 echo "RUNNING PYTEST AND COVERAGE"
 uv run coverage run -m pytest

bin/check-all.jinja

@@ -19,6 +19,10 @@ echo
 echo "RUNNING CODESPELL"
 uv run codespell
 
+echo
+echo "RUNNING ZIZMOR"
+uv run zizmor .
+
 echo
 echo "RUNNING PYTEST AND COVERAGE"
 uv run coverage run -m pytest

mkdocs.yml

@@ -112,6 +112,6 @@ markdown_extensions:
   #      generic: true
 copyright: |
   <div id="left_copyright"><span style="color: grey;">Made with <a href="https://squidfunk.github.io/mkdocs-material/">Material for MkDocs</a></div>
-  <div id="center_copyright"><a href="https://go.microsoft.com/fwlink/?LinkId=521839">Privacy & Cookies</a> | <a href="https://go.microsoft.com/fwlink/?linkid=2259814">Consumer Health Privacy</a> | <a href="https://www.microsoft.com/trademarks">Trademarks</a> | <a href="https://go.microsoft.com/fwlink/?LinkID=206977">Terms of use</a> | © 2025 Microsoft</div>
+  <div id="center_copyright"><a href="https://go.microsoft.com/fwlink/?LinkId=521839">Privacy & Cookies</a> | <a href="https://go.microsoft.com/fwlink/?linkid=2259814">Consumer Health Privacy</a> | <a href="https://www.microsoft.com/trademarks">Trademarks</a> | <a href="https://go.microsoft.com/fwlink/?LinkID=206977">Terms of use</a> | © 2026 Microsoft</div>
 extra:
   generator: false

mkdocs.yml.jinja

@@ -106,7 +106,7 @@ markdown_extensions:
 {% if microsoft_internal -%}
 copyright: |
   <div id="left_copyright"><span style="color: grey;">Made with <a href="https://squidfunk.github.io/mkdocs-material/">Material for MkDocs</a></div>
-  <div id="center_copyright"><a href="https://go.microsoft.com/fwlink/?LinkId=521839">Privacy & Cookies</a> | <a href="https://go.microsoft.com/fwlink/?linkid=2259814">Consumer Health Privacy</a> | <a href="https://www.microsoft.com/trademarks">Trademarks</a> | <a href="https://go.microsoft.com/fwlink/?LinkID=206977">Terms of use</a> | © 2025 Microsoft</div>
+  <div id="center_copyright"><a href="https://go.microsoft.com/fwlink/?LinkId=521839">Privacy & Cookies</a> | <a href="https://go.microsoft.com/fwlink/?linkid=2259814">Consumer Health Privacy</a> | <a href="https://www.microsoft.com/trademarks">Trademarks</a> | <a href="https://go.microsoft.com/fwlink/?LinkID=206977">Terms of use</a> | © 2026 Microsoft</div>
 extra:
   generator: false
 {%- endif %}

pyproject.toml

@@ -9,7 +9,17 @@ readme = "README.md"
 dependencies = []
 
 [dependency-groups]
-dev = ["codespell", "coverage", "ipykernel", "jinja2", "ruff", "pyright", "pytest", "pytest-cov"]
+dev = [
+    "codespell",
+    "coverage",
+    "ipykernel",
+    "jinja2",
+    "ruff",
+    "pyright",
+    "pytest",
+    "pytest-cov",
+    "zizmor",
+]
 docs = [
     "mkdocs",
     "mkdocs-awesome-pages-plugin",

pyproject.toml.jinja

@@ -9,7 +9,7 @@ readme = "README.md"
 dependencies = []                  # write here dependencies of your project
 
 [dependency-groups]
-dev = ["codespell", "coverage", "ipykernel", "ruff", "pyright", "pytest", "pytest-cov"]
+dev = ["codespell", "coverage", "ipykernel", "ruff", "pyright", "pytest", "pytest-cov", "zizmor"]
 {%- if documentation %}
 docs = [
     "mkdocs",