Harden GitHub Actions workflows across usegalaxy-eu repos

[arash77]

Goal

Apply zizmor security best practices to GitHub Actions workflows across all usegalaxy-eu repositories.

Security Improvements

• Add persist-credentials: false to checkout steps
• Fix template injection vulnerabilities
• Add permissions: {} for least-privilege access
• Add zizmor CI workflow for ongoing security scanning
• Add dependabot for GitHub Actions updates

Progress

Completed

• usegalaxy-eu-tools - Harden GitHub Actions workflows with zizmor #1050
• galaxy-social-assistant - Harden GitHub Actions workflows with zizmor galaxy-social-assistant#32
• galaxy-social - Harden GitHub Actions workflows with zizmor galaxy-social#696

Pending

• Infrastructure repositories
• Other tool repositories
• Documentation repositories

References

• zizmor documentation: https://docs.zizmor.sh/
• Galaxy PR example: GitHub workflow improvements recommended by zizmor galaxyproject/galaxy#22827

[arash77]

Moving to usegalaxy-eu/issues