[CI] Add zizmor & trivy update

.github/workflows/reusable_trivy.yml

@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Trivy
-        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
+        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
         with:
           scan-type: 'config'
           hide-progress: false

.github/workflows/zizmor.yml

@@ -0,0 +1,29 @@
+# tool for analyzing GitHub Actions workflows for security issues.
+name: Zizmor
+
+on:
+  push:
+    paths:
+      - '.github/workflows/*.yml'
+  pull_request:
+    paths:
+      - '.github/workflows/*.yml'
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+          sparse-checkout: |
+            .github/workflows/*.yml
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95 # v0.4.1