DEVOPS-977: default zizmor config to allow MiraGeoscience unpinned actions

[andrewg-mira]

DEVOPS-977 - Zizmor: Allow trusted tag-pinned github actions

[sebhmg]

see suggestion for merging config with existing zizmor file

[Copilot]

Pull request overview

Updates the reusable Zizmor workflows and the Zizmor config setup action so CI can allow trusted, tag-pinned MiraGeoscience GitHub Actions while still running Zizmor scans.

Changes:

• Bump setup-zizmor-config action reference in reusable Zizmor workflows from v2 to v3.1.
• Change the setup-zizmor-config composite action to create/patch zizmor.yml via yq.
• Add an unpinned-uses policy for MiraGeoscience/* with ref-pin in the generated/updated config.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
.github/workflows/reusable-zizmor-security.yml	Updates the setup-zizmor-config action ref to v3.1 before running Zizmor.
.github/workflows/reusable-zizmor-annotate.yml	Updates the setup-zizmor-config action ref to v3.1 before running Zizmor with annotations.
.github/actions/setup-zizmor-config/action.yml	Switches from creating a static config to patching/merging config via yq, adding the new policy.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[sebhmg]

suggestion: just change description to

Ensures zizmor.yml exists and patches CI-specific Zizmor rules

[sebhmg]

suggestion: tag v3.1 and move all actions to use v3.1 instead of v2

[sebhmg]

see my suggestions as replies to copilot

(note tag v3.1 does not exist anymore and must be re-created)

[sebhmg]

All required checks passed. Approving for merge.

[sebhmg]

wrong PR. Reverted and forced pushed main, and merging #161 instead