Harden CI: replace curl-pipe-shell with setup-uv action #21

	name: security / zizmor

	on:
	push:
	branches: [main, master]
	paths:
	- '.github/workflows/**'
	- '.github/actions/**'
	- '.github/zizmor.yml'
	- '.github/dependabot.yml'
	pull_request:
	paths:
	- '.github/workflows/**'
	- '.github/actions/**'
	- '.github/zizmor.yml'
	- '.github/dependabot.yml'
	schedule:
	- cron: '0 9 * * 1'
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.event_name == 'schedule' && github.run_id \|\| github.ref }}
	cancel-in-progress: ${{ github.event_name != 'schedule' }}

	permissions:
	contents: read

	jobs:
	zizmor:
	name: Static analysis (zizmor)
	runs-on: ubuntu-latest
	timeout-minutes: 5
	permissions:
	contents: read
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	persist-credentials: false

	- name: Run zizmor
	uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
	with:
	min-severity: medium
	advanced-security: false
	annotations: true
	config: .github/zizmor.yml

Provide feedback