ci: add shared security scanning workflow

[opentelemetrybot]

Tracked in open-telemetry/sig-security#293.

Adds zizmor scanning through the OpenTelemetry shared workflow.

The workflow:

• runs the regular persona on pull requests, pushes to main, and a repository-specific weekly schedule;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[Copilot]

Pull request overview

This PR adds Zizmor GitHub Actions security scanning via the OpenTelemetry shared workflow, and applies several workflow-hardening updates across existing CI/release pipelines (credential persistence, secrets scoping, and safer shell variable handling).

Changes:

• Add a new zizmor workflow that runs on PRs, main pushes, and a weekly schedule, uploading SARIF to GitHub code scanning.
• Harden multiple workflows by disabling persisted checkout credentials and narrowing reusable-workflow secret passing (replacing secrets: inherit with explicit secrets).
• Reduce shell injection/word-splitting risks in workflow run: steps by routing GitHub contexts/inputs through environment variables and quoting.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	Adds shared-workflow-based Zizmor scanning with SARIF upload permissions.
.github/workflows/release-layer-ruby.yml	Disables persisted checkout credentials; scopes reusable-workflow secrets; quotes ref usage for gh commands.
.github/workflows/release-layer-python.yml	Disables persisted checkout credentials; scopes reusable-workflow secrets; quotes ref usage for gh commands.
.github/workflows/release-layer-nodejs.yml	Disables persisted checkout credentials; scopes reusable-workflow secrets; reduces expression interpolation in gh commands.
.github/workflows/release-layer-java.yml	Disables persisted checkout credentials; scopes reusable-workflow secrets; reduces expression interpolation in gh commands.
.github/workflows/release-layer-collector.yml	Disables persisted checkout credentials; scopes reusable-workflow secrets; reduces expression interpolation in gh commands.
.github/workflows/publish-layer-collector.yml	Hardens bash input handling and output generation; disables persisted checkout credentials; scopes reusable-workflow secrets.
.github/workflows/pr-checks.yaml	Adds a zizmor ignore annotation for pull_request_target; disables persisted checkout credentials.
.github/workflows/layer-publish.yml	Declares reusable-workflow secrets; hardens bash usage by passing inputs through env and quoting.
.github/workflows/integration-test.yml	Declares required secret for reusable invocation; hardens bash input handling; disables persisted checkout credentials.
.github/workflows/fossa.yml	Disables persisted checkout credentials.
.github/workflows/codeql.yml	Disables persisted checkout credentials.
.github/workflows/ci-terraform.yml	Disables persisted checkout credentials.
.github/workflows/ci-shellcheck.yml	Disables persisted checkout credentials.
.github/workflows/ci-python.yml	Disables persisted checkout credentials.
.github/workflows/ci-nodejs.yml	Disables persisted checkout credentials.
.github/workflows/ci-java.yml	Disables persisted checkout credentials.
.github/workflows/ci-collector.yml	Disables persisted checkout credentials; quotes env usage in a grep invocation.
.github/workflows/check-links.yaml	Narrows workflow token permissions and disables persisted checkout credentials.
.github/dependabot.yml	Adds per-ecosystem cooldown configuration to update schedules.
.github/actions/build-collector-layer/action.yml	Hardens command invocation by passing action inputs through env and quoting.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tylerbenson]

Seems ok to me....