Improve GitHub Actions security posture

- Add persist-credentials: false to all checkout actions to prevent credential
  persistence in workflow runs
- Add zizmor: ignore[unpinned-uses] comments to intentionally unpinned actions
  to document security decisions
- Add zizmor security checks to check.sh to verify GitHub Actions configuration
  follows security best practices

These changes harden the CI/CD pipeline by reducing credential exposure risk
and automating security verification of GitHub Actions workflow files.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: laurynas-biveinis

.github/workflows/build.yml

@@ -287,6 +287,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Setup common dependencies for Linux
         run: |
@@ -467,7 +468,7 @@ jobs:
         if: env.COVERAGE == 'ON'
 
       - name: Upload coverage data
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v5  # zizmor: ignore[unpinned-uses]
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           flags: ${{matrix.BUILD_TYPE}}

.github/workflows/claude-code-review.yml

@@ -29,10 +29,11 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@beta  # zizmor: ignore[unpinned-uses]
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/claude.yml

@@ -26,10 +26,11 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@beta  # zizmor: ignore[unpinned-uses]
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/codeql-analysis.yml

@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Setup dependencies for Linux
         run: |

.github/workflows/docs.yml

@@ -13,12 +13,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Install Doxygen
         run: sudo apt-get install doxygen
       - name: Generate docs
         run: doxygen Doxyfile
       - name: Deploy docs
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@v4  # zizmor: ignore[unpinned-uses]
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/html/

.github/workflows/examples.yml

@@ -30,6 +30,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           submodules: false
+          persist-credentials: false
 
       - name: Setup dependencies
         run: |

.github/workflows/experimental-build.yml

@@ -30,6 +30,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Set up dependencies for macOS
         run: |

.github/workflows/feature-matrix-build.yml

@@ -32,6 +32,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           submodules: ${{ matrix.TESTS == 'ON' || matrix.BENCHMARKS == 'ON' }}
+          persist-credentials: false
 
       - name: Setup Boost
         run: sudo apt-get install -y libboost-dev

.github/workflows/msvc-build.yml

@@ -58,9 +58,10 @@ jobs:
       - uses: actions/checkout@v5
         with:
           submodules: false
+          persist-credentials: false
 
       - name: Setup command line tools
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@v1  # zizmor: ignore[unpinned-uses]
 
       - name: Install dependencies
         run: |

.github/workflows/old-compilers.yml

@@ -631,6 +631,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Setup common dependencies
         run: |