Summary

The workflows in .github/workflows/ are not scanned by zizmor. Sibling driver repos, including mongo-python-driver, already run this scan. Add it here so workflow security findings surface as code scanning alerts instead of relying on manual review.

Motivation

Who is the affected end user?

Maintainers and reviewers of this repository.

How does this affect the end user?

No automated signal when a workflow change introduces an Actions security problem, such as an over-privileged job or an unpinned third-party action.

How likely is it that this problem or use case will occur?

Every workflow change is a chance to introduce one. Nothing detects regressions.

If the problem does occur, what are the consequences and how severe are they?

A compromised or over-privileged workflow can run with repository permissions.

Is this issue urgent?

No.

Is this ticket required by a downstream team?

No.

Is this ticket only for tests?

Yes. CI-only.

Acceptance Criteria

• A zizmor workflow runs on pushes to master and on pull requests.
• Findings upload to GitHub code scanning.
• The workflow follows the repo's action-pinning conventions.
• Pre-existing findings report as code scanning alerts, not CI failures.