We should integrate https://docs.zizmor.sh/ into the noxfile and run it in CI, like we did in ansible-documentation.