Add zizmor workflow security analysis (#505)

Author: chalin

.github/workflows/zizmor.yaml

@@ -0,0 +1,21 @@
+# Workflow security analysis with zizmor. Maintainer notes:
+# CONTRIBUTING.md#workflow-security-analysis
+
+name: zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '45 9 * * 5' # weekly: refreshes the online audits' advisory data
+  workflow_dispatch:
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read
+      security-events: write # SARIF upload to code scanning
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@03559ef555db0eae5d85c3c6347d1530243e7aa7 # v0.13.0
+    with: { persona: pedantic }

CONTRIBUTING.md

@@ -113,10 +113,38 @@ npm run local -- serve
 The `local` prefix runs the script against the sibling Docsy, and the server
 watches it, so theme edits hot-reload.
 
+### Workflow security analysis
+
+`.github/workflows/zizmor.yaml` runs [zizmor][] over this repo's workflows in
+its pedantic persona (security audits plus workflow hygiene) on every PR, on
+pushes to `main`, and weekly, so the online audits catch advisories published
+against already-pinned actions. Results upload to the repository's Security tab
+as code-scanning alerts.
+
+- The job passes whatever it finds; findings are alerts to triage. Blocking, if
+  any, would come from a code-scanning rule in a ruleset on `main`.
+- The workflow calls the [OpenTelemetry shared workflow][otel-zizmor] at a
+  pinned commit; that workflow pins the zizmor action, which pins the zizmor
+  image by digest, so the scanner moves only when the pin here does. Review the
+  chain at each bump.
+- CI-only by design: the repo carries no tooling dependency for it. For a local
+  run, with `GH_TOKEN` set for the online audits, where _`VERSION`_ is the
+  zizmor version the workflow's latest run logs (its `zizmor vX.Y.Z` banner):
+
+  ```bash
+  uvx zizmor@VERSION --persona=pedantic .
+  ```
+
+- `security-events: write` sits alone in this workflow, away from the job that
+  installs and builds.
+
 [alternate dashboard]: https://app.netlify.com/sites/goldydocs/deploys
 [deploys]: https://app.netlify.com/sites/docsy-example/deploys
 [Docsy]: https://github.com/google/docsy
 [hugo-extended]: https://www.npmjs.com/package/hugo-extended
 [Hugo workspace]: https://gohugo.io/configuration/module/#top-level-settings
+[otel-zizmor]:
+  https://github.com/open-telemetry/shared-workflows/blob/main/zizmor/README.md
+[zizmor]: https://docs.zizmor.sh/
 
 <!-- cSpell:ignore hugo docsy -->