add copilot setup

Author: Garbee

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,62 @@
+name: "Copilot Setup Steps"
+
+# Automatically run the setup steps when they are changed to allow for easy validation, and
+# allow manual testing through the repository's "Actions" tab
+on:
+  workflow_dispatch:
+  push:
+    branches-ignore:
+      - "copilot/**"
+      - "dependabot/**"
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
+  copilot-setup-steps:
+    name: Copilot Setup
+
+    runs-on: ubuntu-24.04
+
+    # Note: Do not try to run inside of a container yet. That causes all the setup scripts
+    # by Copilot to fail since that triggers `sh` instead of `bash` for runs. Setting
+    # defaults to bash does not fix it.
+
+    # Set the permissions to the lowest permissions possible needed for your steps.
+    # Copilot will be given its own token for its operations.
+    permissions:
+      contents: read # Needed to checkout the repository
+
+    # You can define any steps you want, and they will run before the agent starts.
+    # If you do not check out your code, Copilot will do this for you.
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Setup NodeJS
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        with:
+          node-version-file: .node-version
+      - name: Install actionlint
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@latest
+      - name: Install Zizmor
+        env:
+          TMP_DIR: ${{ runner.temp }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euoC pipefail
+          tarball="$TMP_DIR/zizmor.tar.gz"
+          gh release download --repo zizmorcore/zizmor --pattern "zizmor-x86_64-unknown-linux-gnu.tar.gz" --output "$tarball"
+          tar -xzf "$tarball" -C "$TMP_DIR"
+          install -D "$TMP_DIR/zizmor" /usr/local/bin
+          rm "$tarball" "$TMP_DIR/zizmor"