Introduce zizmor

Author: Viicos

.github/actions/build-pgo-wheel/action.yml

@@ -21,7 +21,7 @@ runs:
       run: mkdir -p ${{ github.workspace }}/profdata
 
     - name: build initial wheel
-      uses: PyO3/maturin-action@v1
+      uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad  # v1.50.1
       with:
         manylinux: auto
         args: >
@@ -41,15 +41,17 @@ runs:
         cd crates/jiter-python
         uv pip install jiter --no-index --no-deps --find-links pgo-wheel --force-reinstall
         uv run bench.py jiter jiter-cache
-        rustup run ${{ inputs.rust-toolchain }} bash -c 'echo LLVM_PROFDATA=$RUSTUP_HOME/toolchains/$RUSTUP_TOOLCHAIN/lib/rustlib/$RUST_HOST/bin/llvm-profdata >> "$GITHUB_ENV"'
+        rustup run ${INPUTS_RUST_TOOLCHAIN} bash -c 'echo LLVM_PROFDATA=$RUSTUP_HOME/toolchains/$RUSTUP_TOOLCHAIN/lib/rustlib/$RUST_HOST/bin/llvm-profdata >> "$GITHUB_ENV"'
       shell: bash
+      env:
+        INPUTS_RUST_TOOLCHAIN: ${{ inputs.rust-toolchain }}
 
     - name: merge pgo data
-      run: ${{ env.LLVM_PROFDATA }} merge -o ${{ github.workspace }}/merged.profdata ${{ github.workspace }}/profdata
+      run: ${{ env.LLVM_PROFDATA }} merge -o ${{ github.workspace }}/merged.profdata ${{ github.workspace }}/profdata  # zizmor: ignore[template-injection]
       shell: pwsh # because it handles paths on windows better, and works well enough on unix for this step
 
     - name: build pgo-optimized wheel
-      uses: PyO3/maturin-action@v1
+      uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad  # v1.50.1
       with:
         manylinux: auto
         args: >