feat(ci): add Muninn security scanning and harden workflows

[sg0nzalez]

Summary

• Add Muninn security scanning on pull requests and pushes to main, with SARIF upload to the GitHub Security tab and PR summary comments.
• Add muninn.yml (all eight scanners, fail-on: info) and targeted suppressions for intentional test fixtures and mock credentials.
• Harden existing CI workflows to satisfy Muninn findings:
  • Pin third-party actions to commit SHAs
  • Set explicit workflow permissions and persist-credentials: false on checkout
  • Fix template injection in action.yml by passing inputs through env vars
  • Add Dependabot cooldowns and a zizmor.yml ignore for a publish.yml cache-poisoning false positive
• Ignore local Muninn report artifacts (muninn.json, muninn.sarif) in .gitignore

Test plan

• Muninn workflow runs green on this PR
• SARIF appears in the Security tab
• PR comment summary is posted when findings exist
• Existing workflows (smoke-test, codeql, gitgalaxy) still pass
• GitGalaxy composite action behavior unchanged (smoke tests / manual action run)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[squid-protocol]

Thanks for putting this together! The workflows are looking incredibly solid and the security upgrades are much appreciated.

It looks like the initial CI run tripped up on a minor syntax issue in the setup-python steps. The actions/setup-python action doesn't accept false for the cache parameter; omitting the parameter entirely is the default way to disable caching.

Could you remove the cache: false line from the setup-python blocks across the workflow files (specifically in smoke-test.yml, deploy-docs.yml, publish.yml, and action.yml)?

Change this:

  - name: Set up Python ${{ matrix.python-version }}
    uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
    with:
      python-version: ${{ matrix.python-version }}
      cache: false

To this:

  - name: Set up Python ${{ matrix.python-version }}
    uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
    with:
      python-version: ${{ matrix.python-version }}

Once that is pushed, the automated tests should re-trigger and we can get this merged!

[sg0nzalez]

Thanks for putting this together! The workflows are looking incredibly solid and the security upgrades are much appreciated.

It looks like the initial CI run tripped up on a minor syntax issue in the setup-python steps. The actions/setup-python action doesn't accept false for the cache parameter; omitting the parameter entirely is the default way to disable caching.

Could you remove the cache: false line from the setup-python blocks across the workflow files (specifically in smoke-test.yml, deploy-docs.yml, publish.yml, and action.yml)?

Change this:

  - name: Set up Python ${{ matrix.python-version }}
    uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
    with:
      python-version: ${{ matrix.python-version }}
      cache: false

To this:

  - name: Set up Python ${{ matrix.python-version }}
    uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
    with:
      python-version: ${{ matrix.python-version }}

Once that is pushed, the automated tests should re-trigger and we can get this merged!

Thanks for the review and for pointing that out! I've removed the cache: false entries from the workflow files and pushed the fix. The automated checks should be running again now.

Really appreciate the feedback and the kind words about the workflows and security improvements.