Activate linter for GitHub actions

Author: ArBridgeman

.github/workflows/checks.yml

@@ -226,3 +226,9 @@ jobs:
       - name: Check Workflows
         id: check-workflows
         run: poetry run -- nox -s workflow:check -- all
+
+  lint-github-actions:
+    name: Lint GitHub Actions
+    uses: ./.github/workflows/lint-github-actions.yml
+    permissions:
+      contents: read

exasol/toolbox/templates/github/workflows/checks.yml

@@ -0,0 +1,23 @@
+(( workflow_header ))
+name: Lint GitHub Actions
+on:
+  workflow_call:
+
+jobs:
+  lint-github-actions:
+    runs-on: "(( os_version ))"
+    permissions:
+      contents: read # only needed for private or internal repos
+      actions: read # only needed for private or internal repos
+    steps:
+      - name: Check out Repository
+        id: check-out-repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Lint GitHub actions with Zizmor
+        id: lint-github-actions
+        uses: zizmorcore/zizmor-action@v0.5.3
+        with:
+          advanced-security: false