ci: retire zizmor in favour of jactionlint

.github/workflows/ci.yaml

@@ -36,13 +36,14 @@ jobs:
       # then release.yaml's sync-lockfile commits the lockfile and it passes.
       - run: uv sync --locked
       # Runs the hooks from .pre-commit-config.yaml rather than repeating them
-      # here, so local and CI cannot drift. zizmor is skipped: it has its own
-      # job below, which the ruleset requires by name.
+      # here, so local and CI cannot drift.
       - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204  # v3.0.1
         env:
-          SKIP: zizmor
           # renovate: datasource=github-releases depName=j178/prek extractVersion=^v(?<version>.+)$
           PREK_VERSION: 0.5.5
+          # Turns on jactionlint's online rules, which need the API; local hooks stay offline.
+          JACTIONLINT_ONLINE: 1
+          GITHUB_TOKEN: ${{ github.token }}
         with:
           prek-version: ${{ env.PREK_VERSION }}
 
@@ -144,25 +145,3 @@ jobs:
       - uses: yo61/commitlint-github-action@501ff7bb31eb7133c871318c877d0e43cd1ff500  # v6.3.1
         with:
           configFile: commitlint.config.mjs
-
-  zizmor:
-    name: zizmor
-    runs-on: ubuntu-26.04
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          persist-credentials: false
-      # The zizmor hook from .pre-commit-config.yaml, so its rev is the one zizmor pin. The
-      # token lets zizmor run its online audits (impostor commits, known-vulnerable actions);
-      # without one it skips them and still passes.
-      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204  # v3.0.1
-        env:
-          GH_TOKEN: ${{ github.token }}
-          # renovate: datasource=github-releases depName=j178/prek extractVersion=^v(?<version>.+)$
-          PREK_VERSION: 0.5.5
-        with:
-          prek-version: ${{ env.PREK_VERSION }}
-          extra-args: zizmor --all-files

.pre-commit-config.yaml

@@ -78,8 +78,3 @@ repos:
     rev: 1027f0a131ab98bc7e191d995bfa15dbed5bbf8f  # frozen: v2.2.0
     hooks:
       - id: jactionlint
-
-  - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: fa412071e4f5d44d44f9e365f4676f9df92456a2  # frozen: v1.30.1
-    hooks:
-      - id: zizmor

README.md

@@ -144,8 +144,8 @@ Every pull request runs lint, the pytest matrix (Python 3.11 through 3.15),
 and a bootstrap smoke test that generates two projects from the template
 (one flat, one with DDD layering) and runs the full gate on each, catching
 any file that uses a placeholder the bootstrap script doesn't know about.
-`commitlint` and `zizmor` run as separate checks. `release-please` and
-Dependabot handle releases and dependency updates.
+`commitlint` runs as a separate check. `release-please` and Dependabot handle
+releases and dependency updates.
 
 ## Releases
 

docs/site/content/docs/explanation/ci-shape.mdx

@@ -3,7 +3,7 @@ title: Why CI is shaped this way
 description: The aggregator job, running hooks instead of restating them, and the job that stops the template rotting
 ---
 
-`.github/workflows/ci.yaml` has six jobs where three would do. Each of the
+`.github/workflows/ci.yaml` has five jobs where three would do. Each of the
 extra ones exists to close a specific failure that a simpler shape allows.
 
 ## CI runs the hooks rather than restating them
@@ -21,13 +21,6 @@ because both files look maintained. Running the hook file directly means
 `uv sync --locked` runs before the hook action because the `ruff`, `ty` and
 `pytest` hooks are `uv run --no-sync`, so they need the virtualenv to exist.
 
-## `zizmor` gets its own job
-
-The `lint` job sets `SKIP: zizmor`, and a separate `zizmor` job runs it. That
-looks redundant, and it is deliberate: the branch ruleset requires a check
-named `zizmor`, and a hook running inside `lint` produces no such check. The
-skip stops it running twice.
-
 ## The `test` job runs nothing
 
 `test` is an aggregator. It declares `needs: [lint, pytest, bootstrap]`, runs