ci: scan shared workflow changes

.github/workflows/scan.yml

@@ -85,6 +85,7 @@ jobs:
           ZIZMOR_EXTRA_ARGS: ${{ inputs.zizmor-args }}
         run: |
           # $ZIZMOR_EXTRA_ARGS word-splits by design; it carries flags, not data.
+          # shellcheck disable=SC2086
           docker run --rm -e GH_TOKEN -v "$PWD:/repo" \
             ghcr.io/zizmorcore/zizmor@sha256:863026d54f91271b10b60b67ad8054cb37120167e162482597db102b3026a284 \
             $ZIZMOR_EXTRA_ARGS /repo # 1.29.0

.github/workflows/self-scan.yml

@@ -0,0 +1,22 @@
+name: Scan
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  schedule:
+    - cron: "23 6 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/scan.yml

README.md

@@ -6,3 +6,9 @@ Fallback community-health files for repositories owned by uinaf.
 
 Repository-local files take precedence when a project needs more specific
 security, contribution, or pull-request guidance.
+
+## Verify
+
+Run changed workflow checks locally with `mise run verify`. Before handoff, run
+the exhaustive gate with `mise run --force verify`. The repository self-caller
+runs the shared scan workflow at the pull request's exact revision.

mise.toml

@@ -0,0 +1,16 @@
+[tools]
+actionlint = "1.7.12"
+"pipx:zizmor" = "1.29.0"
+
+[tasks.verify-actions]
+description = "Lint and audit the shared workflows"
+sources = [".github/**/*.yml", ".github/**/*.yaml"]
+run = '''
+actionlint
+zizmor .github/workflows
+'''
+
+[tasks.verify]
+description = "Verify changed organization policy"
+depends = ["verify-actions"]
+run = "git diff --check"