ci: Add actionlint and zizmor jobs to lint workflow

- Integrated `actionlint` to check GitHub Actions workflows.
- Integrated `zizmor` to run security analysis on workflows and upload SARIF files.

Co-authored-by: tswast <247555+tswast@users.noreply.github.com>

Author: google-labs-jules[bot]

.github/workflows/lint.yml

@@ -28,4 +28,32 @@ jobs:
         run: uv sync --locked --all-extras --dev
 
       - name: Run linter
-        run: uv run ruff check
+        run: uv run ruff check
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run actionlint
+        uses: reviewdog/action-actionlint@v1
+
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+      - name: Run zizmor
+        run: uvx zizmor --format sarif . > results.sarif
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor