MAINT: Audit CIs using zizmor

[larsoner]

Not 100% sure about adding this as a pre-commit hook because at least on latest Ubuntu 24.10 I needed a newer rust than was installed on the system, but it was pretty easy to install. An alternative would be to add it as a GitHub action.

[larsoner]

Opened woodruffw/zizmor#236 about pre-commit.ci, we'll see what they say...

[drammock]

I think we need to first decide whether there's value in running locally via pre-commit. If not, then we might as well just run it as a GHA instead of through pre-commit.ci.

I don't like the idea of all contributors (not just maintainers!) needing to install or update Rust just to make a change to MNE. That alone sways me pretty strongly toward GHA / running zizmor only in cloud. The only hesitation I have is that, if someone did introduce a security hole into one of our GHAs, it would be nice to catch that hole locally before it got pushed into a PR and executed.

[larsoner]

Actually they responded to the issue and might try to make it Rust 1.75-compatible, which would work with at least Ubuntu 22.04+. Not sure about macOS or Windows, though.

Could add it to the Style GHA run I suppose

[graingert]

I don't like the idea of all contributors (not just maintainers!) needing to install or update Rust just to make a change to MNE. That alone sways me pretty strongly toward GHA / running zizmor only in cloud. The only hesitation I have is that, if someone did introduce a security hole into one of our GHAs, it would be nice to catch that hole locally before it got pushed into a PR and executed.

no need to install rust anymore! It's a regular python hook - suspiciously similar to ruff

[drammock]

thanks @larsoner and @graingert !