feat: add zizmor gh action (#907)

.github/workflows/benchmarks.yml

@@ -11,6 +11,8 @@ jobs:
     runs-on: self-hosted
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -24,6 +26,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -37,6 +41,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -50,6 +56,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -63,6 +71,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -76,6 +86,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -89,6 +101,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -102,6 +116,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -115,6 +131,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -128,6 +146,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27
@@ -141,6 +161,8 @@ jobs:
     needs: [bench_poseidon]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2023-06-27

.github/workflows/engine.yml

@@ -20,6 +20,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -51,7 +53,7 @@ jobs:
         run: |
           echo '{
             "name": "@ezkljs/engine",
-            "version": "${{ github.ref_name }}",
+            "version": "${RELEASE_TAG}",
             "dependencies": {
               "@types/json-bigint": "^1.0.1",
               "json-bigint": "^1.0.0"
@@ -190,15 +192,17 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Update version in package.json
         shell: bash
         env:
           RELEASE_TAG: ${{ github.ref_name }}
         run: |
-          sed -i "s|\"version\": \".*\"|\"version\": \"${{ github.ref_name }}\"|" in-browser-evm-verifier/package.json
+          sed -i "s|\"version\": \".*\"|\"version\": \"${RELEASE_TAG}\"|" in-browser-evm-verifier/package.json
       - name: Prepare tag and fetch package integrity
         run: |
-          CLEANED_TAG=${{ github.ref_name }} # Get the tag from ref_name
+          CLEANED_TAG=${RELEASE_TAG} # Get the tag from ref_name
           CLEANED_TAG="${CLEANED_TAG#v}" # Remove leading 'v'
           echo "CLEANED_TAG=${CLEANED_TAG}" >> $GITHUB_ENV # Set it as an environment variable for later steps
           ENGINE_INTEGRITY=$(npm view @ezkljs/engine@$CLEANED_TAG dist.integrity)

.github/workflows/large-tests.yml

@@ -9,6 +9,8 @@ jobs:
     runs-on: kaiju
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18

.github/workflows/pypi-gpu.yml

@@ -24,6 +24,8 @@ jobs:
         target: [x86_64]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: 3.12

.github/workflows/pypi.yml

@@ -23,6 +23,8 @@ jobs:
         target: [x86_64, universal2-apple-darwin]
     steps:
       - uses: actions/checkout@v4
+        with: 
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: 3.12
@@ -69,6 +71,8 @@ jobs:
         target: [x64, x86]
     steps:
       - uses: actions/checkout@v4
+        with: 
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: 3.12
@@ -114,6 +118,8 @@ jobs:
         target: [x86_64]
     steps:
       - uses: actions/checkout@v4
+        with: 
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: 3.12
@@ -228,6 +234,8 @@ jobs:
           - x86_64-unknown-linux-musl
     steps:
       - uses: actions/checkout@v4
+        with: 
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: 3.12
@@ -292,6 +300,8 @@ jobs:
             arch: aarch64
     steps:
       - uses: actions/checkout@v4
+        with: 
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: 3.12
@@ -373,7 +383,8 @@ jobs:
     needs: pypi-publish
     steps:
       - uses: actions/checkout@v4
-
+        with: 
+          persist-credentials: false
       - name: Trigger RTDs build
         uses: dfm/rtds-action@v1
         with:

.github/workflows/release.yml

@@ -50,6 +50,9 @@ jobs:
           components: rustfmt, clippy
       - name: Checkout repo
         uses: actions/checkout@v4
+        with: 
+          persist-credentials: false
+
 
       - name: Get release version from tag
         shell: bash
@@ -132,6 +135,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
+        with: 
+          persist-credentials: false
 
       - name: Get release version from tag
         shell: bash

.github/workflows/rust.yml

@@ -24,6 +24,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -36,6 +38,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -48,6 +52,8 @@ jobs:
     runs-on: ubuntu-latest-32-cores
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -71,6 +77,8 @@ jobs:
   #     ENABLE_ICICLE_GPU: true
   #   steps:
   #     - uses: actions/checkout@v4
+        # with:
+        #   persist-credentials: false
   #     - uses: actions-rs/toolchain@v1
   #       with:
   #         toolchain: nightly-2024-07-18
@@ -104,6 +112,8 @@ jobs:
     runs-on: non-gpu
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -137,6 +147,8 @@ jobs:
     runs-on: non-gpu
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -170,6 +182,8 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -186,6 +200,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -212,6 +228,8 @@ jobs:
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -275,6 +293,8 @@ jobs:
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -285,6 +305,8 @@ jobs:
           crate: cargo-nextest
           locked: true
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Use pnpm 8
         uses: pnpm/action-setup@v2
         with:
@@ -354,6 +376,8 @@ jobs:
     needs: [build, library-tests, docs]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -369,6 +393,8 @@ jobs:
       - name: Add rust-src
         run: rustup component add rust-src --toolchain nightly-2024-07-18-x86_64-unknown-linux-gnu
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
       - name: Use pnpm 8
         uses: pnpm/action-setup@v2
         with:
@@ -431,6 +457,8 @@ jobs:
   #     ENABLE_ICICLE_GPU: true
   #   steps:
   #     - uses: actions/checkout@v4
+        # with:
+        #   persist-credentials: false
   #     - uses: actions-rs/toolchain@v1
   #       with:
   #         toolchain: nightly-2024-07-18
@@ -465,6 +493,8 @@ jobs:
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -483,6 +513,8 @@ jobs:
   #     ENABLE_ICICLE_GPU: true
   #   steps:
   #     - uses: actions/checkout@v4
+        # with:
+        #   persist-credentials: false
   #     - uses: actions-rs/toolchain@v1
   #       with:
   #         toolchain: nightly-2024-07-18
@@ -500,6 +532,8 @@ jobs:
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -517,6 +551,8 @@ jobs:
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -538,6 +574,8 @@ jobs:
     needs: [build, library-tests, docs]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: nightly-2024-07-18
@@ -555,6 +593,8 @@ jobs:
     needs: [build, library-tests, docs]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: "3.12"
@@ -581,6 +621,8 @@ jobs:
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: "3.12"
@@ -628,6 +670,8 @@ jobs:
           - 5432:5432
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v4
         with:
           python-version: "3.11"
@@ -680,6 +724,8 @@ jobs:
       runs-on: macos-latest
       steps:
         - uses: actions/checkout@v4
+          with:
+            persist-credentials: false
         - uses: actions-rs/toolchain@v1
           with:
             toolchain: nightly-2024-07-18
@@ -698,6 +744,8 @@ jobs:
 
       steps:
         - uses: actions/checkout@v4
+          with:
+            persist-credentials: false
         - uses: actions-rs/toolchain@v1
           with:
             toolchain: nightly-2024-07-18

.github/workflows/static-analysis.yml

@@ -0,0 +1,32 @@
+name: Static Analysis
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions-rs/toolchain@v1
+        with:
+          toolchain: nightly-2024-07-18
+          override: true
+          components: rustfmt, clippy
+
+      # Run Zizmor static analysis
+
+      - name: Install Zizmor
+        run: cargo install --locked zizmor
+
+      - name: Run Zizmor Analysis
+        run: zizmor .
+
+
+    

.github/workflows/swift-pm.yml

@@ -12,15 +12,18 @@ jobs:
     runs-on: macos-latest
     env:
       EZKL_SWIFT_PACKAGE_REPO: github.com/zkonduit/ezkl-swift-package.git
+      RELEASE_TAG: ${{ github.ref_name }}
 
     steps:
       - name: Checkout EZKL
         uses: actions/checkout@v3
+        with: 
+          persist-credentials: false
 
       - name: Extract TAG from github.ref_name
         run: |
           # github.ref_name is provided by GitHub Actions and contains the tag name directly.
-          TAG="${{ github.ref_name }}"
+          TAG="${RELEASE_TAG}"
           echo "Original TAG: $TAG"
           # Remove leading 'v' if present to match the Swift Package Manager version format.
           NEW_TAG=${TAG#v}
@@ -106,7 +109,6 @@ jobs:
           cd ezkl-swift-package
           git add Sources/EzklCoreBindings Tests/EzklAssets
           git commit -m "Automatically updated EzklCoreBindings for EZKL"
-          
           if ! git push origin; then
             echo "::error::Failed to push changes to ${{ env.EZKL_SWIFT_PACKAGE_REPO }}. Please ensure that EZKL_PORTER_TOKEN has the correct permissions."
             exit 1
@@ -116,7 +118,6 @@ jobs:
         run: |
           cd ezkl-swift-package
           source $GITHUB_ENV
-          
           # Tag the latest commit on the current branch
           if git rev-parse "$TAG" >/dev/null 2>&1; then
             echo "Tag $TAG already exists locally. Skipping tag creation."

.github/workflows/tagging.yml

@@ -12,6 +12,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Bump version and push tag
         id: tag_version
         uses: mathieudutour/github-tag-action@v6.2