> A static analysis tool for Github Actions
https://github.com/woodruffw/zizmor
Mostly means adding `persist-credentials: false` to checkouts and replacing `{{ env.VARNAME }}` with shell substitution.
Since `docs/prep` is a prerequisite of `docs`, and should be the *only* prerequisite, calling `make docs` could end up hiding a problem with files missing from the uploaded artifact. Instead, call `make` from the docs directory which should be closer to what will run on RTDs.