workflow: Enable advanced security to for zizmor

[zoechanzy]

What does this Pull Request accomplish?

• Add security-events: write for check_workflows
• Enable advanced security to for zizmor

Why should this Pull Request be merged?

Advanced security of zizmor is disabled because the repo was set to internal.
Since the repo is public now, we should enable advanced security for zizmor so that it can report errors via GitHub Advanced Security:

Related work item:
https://dev.azure.com/ni/DevCentral/_workitems/edit/3776265

[ni-github-admins]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Test Results

   14 files  ±0     14 suites  ±0   15m 8s ⏱️ -35s
  224 tests ±0    224 ✅ ±0  0 💤 ±0  0 ❌ ±0 
3 136 runs  ±0  3 136 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit d72495d. ± Comparison against base commit 0903e49.

[Copilot]

Pull request overview

This PR enables GitHub Advanced Security reporting for the zizmor workflow by granting the required security-events: write permission and removing the explicit disablement of advanced security in the zizmor action configuration.

Changes:

• Add security-events: write to the caller workflow (PR.yml) so the reusable CI.yml workflow can upload security events when run via PRs.
• Add security-events: write to the check_workflows job in CI.yml (reusable workflow call) to allow its called workflow to publish security events.
• Remove advanced-security: false from the zizmorcore/zizmor-action invocation to allow advanced security reporting.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/PR.yml	Grants security-events: write to the reusable CI workflow when invoked from PRs.
.github/workflows/CI.yml	Adds security-events: write permission specifically to the check_workflows reusable-workflow job.
.github/workflows/check_workflows.yml	Enables zizmor’s advanced security reporting by removing the explicit disable flag and granting security-events: write.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.