ci: Update GitHub Actions workflows based on Zizmor security reports

[DhavalGojiya]

Description

Update GitHub Actions workflows based on Zizmor security reports.

Command:
uvx zizmor .github/

[DhavalGojiya]

CC: @cclauss

So I intentionally made pre-commit fail because I wanted to see how:

- uses: pre-commit-ci/[email protected]
   if: always()

behaves. Do you know why it didn't create a new commit on this PR to fix the whitespace issue?
If this action does not create any type of commit, then we can simply remove it from the workflow entirely.

[cclauss]

I gotta say that I am not a fan so far. This tool generated a lot of busy work on other repos for fixes that were not really helpful.

I am unsure on pre-commit-ci/lite-action because I always use https://pre-commit.ci instead.

[DhavalGojiya]

I gotta say that I am not a fan so far. This tool generated a lot of busy work on other repos for fixes that were not really helpful.

I am unsure on pre-commit-ci/lite-action because I always use https://pre-commit.ci instead.

True. Let me remove this one.

[cclauss]

This might be why pre-commit-ci/lite-action cannot write a commit.

[DhavalGojiya]

But the pre-commit lite action is defined inside .github/workflows/ci-test.yml,
and the job where it's defined already has all the required permissions.

I think I haven't configured the pre-commit lite CI bot in this repo.
That's probably the reason. Anyway, I'm going to remove this job.

[cclauss]

Oh...

Make the whitespace change to a non-GitHub Actions file. I think that GitHub Actions cannot write to a GHA file.

trim trailing whitespace.................................................Failed
- hook id: trailing-whitespace
- exit code: 1
- files were modified by this hook

Fixing .github/workflows/ci-test.yml

biome check..............................................................Passed

[DhavalGojiya]

Not working with the action.yml whitespace issue either.

[DhavalGojiya]

Let's do a final test. I just added the pre-commit CI lite bot to this repo.

[DhavalGojiya]

boom.
Working after pre-commit CI lite bot added to this repo.