DEVOPS-1129: combine zizmor workflows

.github/workflows/reusable-zizmor.yml

@@ -0,0 +1,48 @@
+name: Zizmor analysis
+
+on:
+  workflow_call:
+    inputs:
+      min_severity:
+        description: "Minimum severity: informational|low|medium|high"
+        required: false
+        default: medium
+        type: string
+      min_confidence:
+        description: "Minimum confidence: low|medium|high"
+        required: false
+        default: low
+        type: string
+      persona:
+        description: "Audit persona: regular|pedantic|auditor"
+        required: false
+        default: regular
+        type: string
+jobs:
+  zizmor:
+    name: Security Scan
+    if: ${{ (github.event_name != 'pull_request') || (github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      checks: write
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Setup Zizmor Config
+        uses: $/.github/actions/setup-zizmor-config
+
+      - name: Run Zizmor Security Scan
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: ${{ github.event_name != 'pull_request' }}
+          annotations: ${{ github.event_name == 'pull_request' }}
+          persona: ${{ inputs.persona }}
+          min-severity: ${{ inputs.min_severity }}
+          min-confidence: ${{ inputs.min_confidence }}

.github/workflows/security_scan.yml

@@ -24,20 +24,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  call-workflow-zizmor-annotate:
-    name: Zizmor analysis (advanced security)
-    if: ${{ github.event_name != 'pull_request' }}
+  zizmor:
+    name: Zizmor analysis
     permissions:
       security-events: write
-      contents: read
-      actions: read
-    uses: ./.github/workflows/reusable-zizmor-advanced-security.yml
-
-  call-workflow-zizmor-advanced-security:
-    name: Zizmor analysis (annotate)
-    if: ${{ github.event_name == 'pull_request' }}
-    permissions:
       checks: write
       contents: read
       actions: read
-    uses: ./.github/workflows/reusable-zizmor-annotate.yml
+    uses: ./.github/workflows/reusable-zizmor.yml