ci: move security scanning to shared workflow

[opentelemetrybot]

Tracked in open-telemetry/sig-security#293.

Moves existing zizmor scanning to the OpenTelemetry shared workflow.

The workflow:

• runs the pedantic persona on pull requests, pushes to main;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Confirm open-telemetry/admin continues to require zizmor code scanning for this repository.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Moves the repository’s zizmor security scan from a locally-defined reusable workflow to the OpenTelemetry shared zizmor workflow, and runs it directly on PRs / main / schedule with SARIF upload to GitHub Code Scanning.

Changes:

• Replaced the in-repo zizmor job steps with a call to open-telemetry/shared-workflows pinned to an immutable commit.
• Changed zizmor execution from workflow_call (invoked by checks.yml) to direct workflow triggers (pull_request, push to main, schedule, workflow_dispatch).
• Removed the zizmor job from checks.yml since it’s now a standalone workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/zizmor.yml	Switches zizmor scanning to the shared workflow and adds direct triggers + SARIF upload permissions.
.github/workflows/checks.yml	Removes the zizmor job previously calling the local reusable workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[julianocosta89]

@trask 2 questions on this PR.

1. Can I update it to ready for review and follow the "After merge" steps?
2. Should we address the copilot findings?

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[trask]

@trask 2 questions on this PR.

1. Can I update it to ready for review and follow the "After merge" steps?
2. Should we address the copilot findings?

sorry, the rollout got stalled, PR should be good to go now