chore: add Zizmor (#2157)

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Signed-off-by: Jay DeLuca <jaydeluca4@gmail.com>

Author: zeitlinger

.gitattributes

@@ -0,0 +1,3 @@
+CHANGELOG.md linguist-generated
+**/src/main/generated/** linguist-generated
+docs/** linguist-documentation

.github/config/flint.toml

@@ -1,7 +1,5 @@
 [settings]
-# These paths are generated, vendored, or handled by other checks.
-exclude = ["CHANGELOG.md", "**/src/main/generated/**", "docs/themes/**", "mvnw", "simpleclient-archive/**"]
-setup_migration_version = 2
+exclude = ["docs/themes/**", "mvnw", "simpleclient-archive/**"]
 
 [checks.renovate-deps]
 exclude_managers = ["github-actions", "github-runners", "maven"]

.github/renovate-tracked-deps.json

@@ -36,12 +36,12 @@
         "mise"
       ]
     },
-    ".github/workflows/micrometer-compatibility.yml": {
+    ".github/workflows/lint.yml": {
       "regex": [
         "mise"
       ]
     },
-    ".github/workflows/lint.yml": {
+    ".github/workflows/micrometer-compatibility.yml": {
       "regex": [
         "mise"
       ]
@@ -138,7 +138,8 @@
         "shellcheck",
         "shfmt",
         "taplo",
-        "typos"
+        "typos",
+        "zizmor"
       ]
     },
     "mvnw": {

.github/renovate.json5

@@ -1,6 +1,6 @@
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
-  extends: ["config:best-practices", "config:recommended", "github>grafana/flint#v0.22.2"],
+  extends: ["config:best-practices", "config:recommended", "github>grafana/flint#v0.22.4"],
   platformCommit: "enabled",
   automerge: true,
   ignorePaths: [

.github/workflows/micrometer-compatibility.yml

@@ -35,9 +35,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-maven-
       - name: Run Micrometer compatibility tests
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            export MICROMETER_REPOSITORY="${{ github.event.inputs.micrometer-repository }}"
-            export MICROMETER_REF="${{ github.event.inputs.micrometer-ref }}"
-          fi
-          mise run micrometer:test
+        env:
+          MICROMETER_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.micrometer-repository || 'micrometer-metrics/micrometer' }}
+          MICROMETER_REF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.micrometer-ref || 'main' }}
+        run: mise run micrometer:test

.github/workflows/release-please.yml

@@ -28,6 +28,7 @@ jobs:
         if: ${{ steps.release-please.outputs.releases_created == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ steps.release-please.outputs.tag_name }}
         run: >
           gh workflow run release.yml --repo "${GITHUB_REPOSITORY}"
-          -f tag=${{ steps.release-please.outputs.tag_name }}
+          -f "tag=${TAG_NAME}"

AGENTS.md

@@ -102,7 +102,15 @@ Pre-built instrumentations:
 - Do not prefix PR titles with `[codex]`.
 - Match the PR title type to the primary user-facing change.
 
-## Linting and Validation
+## Linting
+
+Run `mise run lint:fix` before committing changes.
+If output includes `fixed`, keep those changes.
+If output includes `partial` or `review`, address the remaining issues and
+run `mise run lint:fix` again.
+
+Example output:
+flint: fixed: gofmt — commit before pushing | partial: cargo-clippy
 
 **CRITICAL**: These checks MUST be run before creating any
 commits. CI will fail if these checks fail.
@@ -117,39 +125,6 @@ commits. CI will fail if these checks fail.
   - Build succeeds (tests are skipped;
     run `mise run test` or `mise run test-all` for tests)
 
-### Non-Java Files (Markdown, YAML, JSON, shell scripts)
-
-- **ALWAYS** run `mise run lint` after modifying non-Java
-  files (runs super-linter + link checking + BOM check)
-- `mise run lint:fix` autofixes linting issues
-- Super-linter will **autofix** many issues
-  (formatting, trailing whitespace, etc.)
-- It only reports ERROR-level issues
-  (configured via `LOG_LEVEL=ERROR` in
-  `.github/super-linter.env`)
-- Common issues caught:
-  - Lines exceeding 100 characters in Markdown files
-  - Missing language tags in fenced code blocks
-  - Table formatting issues
-  - YAML/JSON syntax errors
-
-### Running Linters
-
-```bash
-# After modifying Java files (run BEFORE committing)
-mise run build
-
-# After modifying non-Java files (run BEFORE committing)
-mise run lint
-# or to autofix: mise run lint:fix
-```
-
-### Before Pushing
-
-**ALWAYS** run `mise run lint` before pushing to verify
-all lints pass. CI runs the same checks and will fail
-if any lint is violated.
-
 ## Testing
 
 - JUnit 5 (Jupiter) with `@Test` annotations

mise.toml

@@ -7,7 +7,7 @@ protoc = "35.0"
 
 # Linters
 actionlint = "1.7.12"
-"aqua:grafana/flint" = "0.22.2"
+"aqua:grafana/flint" = "0.22.4"
 "aqua:jonwiggins/xmloxide" = "v0.4.3"
 "aqua:owenlamont/ryl" = "0.10.0"
 biome = "2.4.12"
@@ -21,6 +21,7 @@ shellcheck = "v0.11.0"
 shfmt = "3.13.1"
 taplo = "0.10.0"
 typos = "1.46.3"
+zizmor = "1.25.2"
 
 [env]
 FLINT_CONFIG_DIR = ".github/config"