ci: enforce the zizmor action-pinning policy on the template's workflows

[devantler]

🤖 Generated by the Daily AI Assistant

Problem

The template's two deliverables are the deploy/ Kustomize scaffold and the framework-agnostic .github/workflows/ plumbing — both template-owned and propagated to every tenant via template-sync. #3 added validate-scaffold.yaml to gate the scaffold, but the workflow half was unguarded:

• zizmor.yml declared an action-pinning policy that no workflow ever ran — dead config.
• The README's Owned by the template table claimed zizmor.yml was "enforced by the security scan," but no security scan existed — inaccurate docs.
• Net result: an unpinned or insecure change to the template-owned plumbing could merge green and ship downstream to every tenant.

Change

Consolidate the scaffold gate and a new security scan into a single template-repo-only validation workflow:

• Rename validate-scaffold.yaml → validate-template.yaml and add a zizmor job beside the existing kustomize-build job. Both are guarded if: github.repository == 'devantler-tech/gitops-tenant-template', so they no-op in tenants (symmetric to cd.yaml/release.yaml). One workflow file keeps tenant check-noise to a single perpetually-skipped run instead of two.
• The zizmor job uses zizmorcore/zizmor-action (hash-pinned v0.5.6) — the same scanner the rest of the portfolio runs (e.g. devantler-tech/actions) — and enforces the existing zizmor.yml policy against the template's workflows.
• README's owned-files table and Validate locally block updated to match (the zizmor.yml claim is now true; the local zizmor .github/workflows/ command added for CI parity).

Validation (local)

• zizmor --config zizmor.yml .github/workflows/ → No findings to report (clean across all 5 workflows incl. the new one) ✅
• actionlint .github/workflows/validate-template.yaml → clean ✅
• kubectl kustomize deploy/ → unchanged (the existing job is byte-identical) ✅

Note for the maintainer

Like Validate Scaffold before it (per #3's body), these jobs run and are visible but do not yet gate merges — the branch ruleset still requires only CI - Required Checks. If you'd like them to block, add Validate Scaffold and Scan Workflows (zizmor) to the main ruleset's required-status-checks (a ruleset change is yours to make).

[Copilot]

Pull request overview

Consolidates template-repo CI gates into a single validate-template.yaml workflow that runs both the existing kustomize scaffold check and a new zizmor action-pinning scan, making the previously-dead zizmor.yml policy actually enforced.

Changes:

• Renames validate-scaffold.yaml → validate-template.yaml and adds a zizmor job alongside the existing kustomize-build job, both guarded to run only in the template repo.
• Uses zizmorcore/zizmor-action@v0.5.6 (hash-pinned) to enforce the existing zizmor.yml policy across all template workflows.
• Updates README's owned-files table and Validate locally block to reflect the renamed workflow and the now-real zizmor enforcement.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate-template.yaml	New consolidated workflow with validate-scaffold and zizmor jobs, both template-repo-only.
.github/workflows/validate-scaffold.yaml	Deleted; superseded by validate-template.yaml.
README.md	Updates owned-files table and local-validation block to reference the new workflow and zizmor command.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[devantler]

🤖 Generated by the Daily AI Assistant

Closing — this PR is based on a false premise. The org-wide ruleset ScanGitHubActions (.github/workflows/scan-for-workflow-vulnerabilities.yaml, "🔍 Scan for Workflow Vulnerabilities") already runs zizmor on every repo's PRs, so the Scan Workflows (zizmor) job here duplicates existing scanning. zizmor.yml was therefore never dead config — it is enforced, by the org scan — and the README's original "enforced by the security scan" wording was already accurate (my edit wrongly re-attributed it to a local workflow).

Nothing to salvage: the rename + README changes existed only to host the now-redundant job. The repo already has the deploy/ scaffold gate (#3), org-wide zizmor, and a correct README. No changes to main.