ci: add github actions lint (zizmor), pin actions, use uv

[chirizxc]

/close #6171

Add zizmor to CI:

• pin all actions by commit via actions-up
• add permissions: {} where not yet
• use YAML anchors / ENV's for reducing duplication
• add persist-credentials: false for actions/checkout
• pip -> uv / uvx

[davidhewitt]

Thanks, generally looks great! A few thoughts / questions.

[davidhewitt]

Clever trick! I'm a little worried github could break this in future, and that it might pollute env. Would it be simpler to just set it as an env var here? _PYO3_CI_ENABLE_CACHE_SAVE: ${{ github.ref ...

[chirizxc]

For example: ${{ env._PYO3_CI_ENABLE_FAIL_FAST }} will not be available in strategy.fail-fast, since it is evaluated before the job is created, and the env context is not available at that point.

[chirizxc]

GitHub have examples in the documentation; I don't think they'll change this behavior🧐

[davidhewitt]

I guess this is just reducing the number of secrets passed down?

[chirizxc]

yes

[chirizxc]

https://docs.zizmor.sh/audits/#before_14

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
   --> .github/workflows\ci.yml:330:11
    |
330 |     uses: ./.github/workflows/build.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
340 |     secrets: inherit
    |     ---------------- inherits all parent secrets
    |
    = note: audit confidence → High

108 findings (29 ignored, 78 suppressed): 0 informational, 0 low, 1 medium, 0 high

[davidhewitt]

Why skip the check if a previous step failed (does GH successfully mark the check as failed?)

[chirizxc]

I just reverted it back; it looks like jq works fine

[codspeed-hq]

Merging this PR will improve performance by 10.06%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 139 untouched benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	ordered_richcmp	2.6 µs	2.3 µs	+10.06%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing chirizxc:ci (9242378) with main (8fcf8fc)}