Add zizmor to lint stage

Author: Ickerday

Makefile

@@ -22,7 +22,11 @@ ci-install:
 
 UV_RUN_CMD := uv run --frozen --no-config
 .PHONY: lint
-lint: lint-python # TODO: Add mbake
+lint: lint-python lint-gh-actions # TODO: Add mbake
+
+.PHONY: lint-gh-actions
+lint-gh-actions:
+	$(UV_RUN_CMD) zizmor --pedantic --collect=all --strict-collection .
 
 .PHONY: lint-python
 lint-python:
@@ -32,7 +36,11 @@ lint-python:
 
 UV_RUN_CMD := uv run --frozen --no-config
 .PHONY: ci-lint
-ci-lint: ci-lint-python # TODO: Add mbake
+ci-lint: ci-lint-python ci-lint-gh-actions # TODO: Add mbake
+
+.PHONY: ci-lint-gh-actions
+ci-lint-gh-actions:
+	$(UV_RUN_CMD) zizmor --pedantic --collect=all --strict-collection --fix .
 
 .PHONY: ci-lint-python
 ci-lint-python:

pyproject.toml

@@ -39,7 +39,7 @@ openai = ["splunk-sdk[ai]>=2.1.1", "langchain-openai>=1.2.1"]
 google = [
   "splunk-sdk[ai]>=2.1.1",
   "langchain-google-genai==4.2.2",
-  "google-auth>=2.51.0",
+  "google-auth>=2.52.0",
 ]
 
 # Treat the same as NPM's `devDependencies`
@@ -53,7 +53,7 @@ test = [
   "vcrpy>=8.1.1",
 ]
 release = ["build>=1.5.0", "jinja2>=3.1.6", "sphinx>=9.1.0", "twine>=6.2.0"]
-lint = ["basedpyright>=1.39.3", "ruff>=0.15.12", "mbake>=1.4.6"]
+lint = ["basedpyright>=1.39.3","mbake>=1.4.6", "ruff>=0.15.12", "zizmor==1.24.1"]
 dev = [
   "rich>=15.0.0",
   { include-group = "test" },