ci: require zizmor in final (#1535)

<!-- entire-trail-link-start -->
https://entire.io/gh/jdx/usage/trails/80
<!-- entire-trail-link-end -->

zizmor ran as its own workflow (\`zizmor.yml\`), so the \`final\` check
that branch protection requires never saw it. A zizmor failure could not
block merging.

This moves the zizmor job into \`test.yml\` and makes \`final\` depend
on it:

- Adds a \`zizmor\` job to \`test.yml\` with the same steps, pinned SHAs
and \`advanced-security: false\` as before, and \`contents: read\`
permissions.
- Adds \`zizmor\` to \`final\`'s \`needs\`. \`final\` now fails unless
\`needs.zizmor.result == success\`, so a failed, cancelled or skipped
zizmor run blocks the merge.
- Deletes \`zizmor.yml\`.

Behavior change: zizmor previously ran only on pushes to main and on PRs
touching \`.github/workflows/**\`. It now runs on every PR and push,
because a path-filtered job would be skipped and a skipped job would
fail \`final\`. It is a short job.

Not validated locally beyond reading the diff: no YAML parser,
actionlint or zizmor was usable here. CI on this PR is the validation.
Mirrors jdx/hk#1679.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
*AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5;
version: unavailable.*

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> CI workflow wiring only; no runtime or application code changes.
> 
> **Overview**
> **Moves the zizmor workflow security scan into `test.yml` so branch
protection’s `final` check can block merges when it fails.**
> 
> The standalone `.github/workflows/zizmor.yml` is removed and replaced
with a `zizmor` job in `test.yml` (same pinned actions and
`advanced-security: false`). `final` now lists `zizmor` in `needs` and
exits non-zero unless `needs.zizmor.result` is `success`, so failed,
cancelled, or skipped zizmor runs fail the required check.
> 
> **Behavior change:** zizmor previously ran only on `main` pushes and
PRs touching `.github/workflows/**`; it now runs on every `test`
workflow trigger so a path-filtered skip would not fail `final`.
> 
> Also updates a version comment on
`apple-actions/import-codesign-certs` in `publish-cli.yml` (`# v7` → `#
v7.0.0`).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
fcc1959. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* The test workflow now runs an additional security scan, and the final
check requires that scan to succeed.
* The separate workflow that ran security scans on pushes to the main
branch and qualifying pull requests has been removed. Security scanning
is now part of the test workflow instead.
  * No changes to app functionality are included.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: jdx

.github/workflows/publish-cli.yml

@@ -104,7 +104,7 @@ jobs:
           experimental: true
           cache: false
       - if: matrix.os == 'macos-latest'
-        uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7
+        uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7.0.0
         with:
           p12-file-base64: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTS_P12 }}
           p12-password: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTS_P12_PASS }}

.github/workflows/test.yml

@@ -24,19 +24,38 @@ jobs:
     with:
       trusted: false
 
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false
+
   final:
     name: final
     if: ${{ always() && !cancelled() && needs.trusted.result != 'cancelled' && needs.untrusted.result != 'cancelled' }}
     permissions: {}
-    needs: [trusted, untrusted]
+    needs: [trusted, untrusted, zizmor]
     runs-on: ubuntu-latest
     timeout-minutes: 1
     steps:
       - name: Check selected workflow result
         env:
           TRUSTED_RESULT: ${{ needs.trusted.result }}
           UNTRUSTED_RESULT: ${{ needs.untrusted.result }}
+          ZIZMOR_RESULT: ${{ needs.zizmor.result }}
         run: |
+          if [[ "$ZIZMOR_RESULT" != success ]]; then
+            echo "zizmor=$ZIZMOR_RESULT"
+            exit 1
+          fi
           if [[ "$TRUSTED_RESULT" == success && "$UNTRUSTED_RESULT" == skipped ]] ||
              [[ "$TRUSTED_RESULT" == skipped && "$UNTRUSTED_RESULT" == success ]]; then
             exit 0