ci: more safe ci using zizmor

[yihong0618]

What's changed and what's your intention?

Please explain IN DETAIL what the changes are in this PR and why they are needed. :D

As more and more attackers using GitHub Actions to steal the token or attack other users such as Mining Scripts

this patch fix more of them

zizmor: https://woodruffw.github.io/zizmor/

more can check issue one-api or https://www.praetorian.com/blog/compromising-bytedances-rspack-github-actions-vulnerabilities/
we can use static check to avoid them as we can.

e.g.:

astral-sh/ruff#14844

same request for opendal apache/opendal#5502

Checklist

• I have written the necessary rustdoc comments
• I have added the necessary unit tests and integration tests
• I have passed make all (or make fast instead if the old tests are not modified) in my local environment.

Related issues or PRs (optional)

[MrCroxx]

LGTM

Thank you for your contribution, @yihong0618 🥰

And thank you for letting me know zizmor. The tool looks great.

Let me check if there is some way to include zizmor in CI, instead of checking it locally everytime when updating the CI workflow.

[MrCroxx]

Please don't mind the failing CI on arm instances. It is a bug from the Github side. I'll rerun the failed test on arm instances.

There is a link to the issue. Please check if you want to learn about it. 🙏 actions/partner-runner-images#47

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

see 2 files with indirect coverage changes

[yihong0618]

Please don't mind the failing CI on arm instances. It is a bug from the Github side. I'll rerun the failed test on arm instances.

There is a link to the issue. Please check if you want to learn about it. 🙏 actions/partner-runner-images#47

copy that, thanks