ci: adds zizmor action

[bmuenzenmeyer]

Same as doc-kit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nodejs-learn	Ready	Preview	Sep 23, 2026 12:08pm UTC

[github-actions]

👋 Codeowner Review Request

The following codeowners have been identified for the changed files:

Team reviewers: @nodejs/web-infra

Please review the changes when you have a chance. Thank you! 🙏

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Copilot review overview

🟡 Changes recommended

Fix the invalid branch filter and prevent fork pull request SARIF uploads from failing.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Use a list for the push branches filter · New

What changed in this PR

Adds a GitHub Actions workflow to scan repository workflows with zizmor.

Changes:

• Runs on pushes and pull requests targeting main.
• Uses pinned actions and restricted permissions.
• Uploads SARIF results to GitHub Advanced Security.

File	Review findings
.github/​workflows/​zizmor.yml	Critical: branches must use list syntax; the current scalar form invalidates the workflow. Moderate: Advanced Security uploads can fail for fork pull requests due to restricted token permissions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.