ci: add shared security scanning workflow

[opentelemetrybot]

Tracked in open-telemetry/sig-security#293.

Adds zizmor scanning through the OpenTelemetry shared workflow.

The workflow:

• runs the regular persona on pull requests, pushes to main, and a randomized weekly schedule;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Adds organization-standard Zizmor GitHub Actions security scanning (via OpenTelemetry shared workflows) and applies related workflow-hardening tweaks across existing CI automation (checkout credential persistence, action pinning, and minor workflow hygiene).

Changes:

• Add a new .github/workflows/zizmor.yml workflow that runs the shared Zizmor scanner and uploads SARIF to GitHub code scanning.
• Harden multiple workflows by setting actions/checkout to persist-credentials: false where pushes are not needed, and add targeted Zizmor ignore metadata where appropriate.
• Pin several third-party actions to immutable SHAs in the shared .github/actions/setup composite action and add Dependabot update cooldown.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	Adds shared Zizmor scanning workflow with minimal permissions and SARIF upload.
.github/workflows/update-target-allocator-chart.yaml	Updates reusable-workflow invocation for chart updates (but currently drops secret inheritance).
.github/workflows/update-obi-chart.yaml	Updates reusable-workflow invocation for chart updates (but currently drops secret inheritance).
.github/workflows/ta-test.yaml	Disables persisted checkout credentials for a test workflow checkout.
.github/workflows/sync-readme.yaml	Disables persisted credentials for the read-only checkout; keeps persisted token where pushing is required.
.github/workflows/release.yaml	Disables persisted checkout credentials and refactors Helm registry login to use env vars.
.github/workflows/pre-commit.yaml	Disables persisted checkout credentials.
.github/workflows/operator-test.yaml	Disables persisted checkout credentials for operator test workflows.
.github/workflows/lint.yaml	Disables persisted checkout credentials.
.github/workflows/kube-stack-test.yaml	Disables persisted checkout credentials.
.github/workflows/fossa.yml	Disables persisted checkout credentials.
.github/workflows/ebpf-test.yaml	Disables persisted checkout credentials.
.github/workflows/ebpf-instrumentation-test.yaml	Disables persisted checkout credentials.
.github/workflows/demo-test.yaml	Disables persisted checkout credentials.
.github/workflows/collector-test.yaml	Disables persisted checkout credentials.
.github/dependabot.yml	Adds Dependabot update cooldown configuration.
.github/actions/setup/action.yaml	Pins setup actions to immutable SHAs (Helm, Python, chart-testing, kind).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

[TylerHelmuth]

Blocking because I dont want to accidentally merge in new private key change if we dont need it.

[TylerHelmuth]

@trask do you know what this is being added?

[trask]

The reusable workflow already uses OTELBOT_PRIVATE_KEY to create an OTelBot token. Previously, callers used secrets: inherit, which exposed every available repository secret. This PR narrows that to only OTELBOT_PRIVATE_KEY.