ci: bump zizmor from 1.25.2 to 1.28.0 in /.github/zizmor

[dependabot]

Bumps zizmor from 1.25.2 to 1.28.0.

Release notes

Sourced from zizmor's releases.

v1.28.0

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

v1.27.0

New Features 🌈🔗

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153) Enhancements 🌱🔗

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛🔗

• Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#2157)

• Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#2177)

• Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#2185)

v1.26.1

This is a small corrective release for 1.26.0.

v1.26.0

New Features 🌈🔗

• New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#1985)

  Many thanks to @​andrew for proposing and implementing this improvement!

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.28.0

Security 🔒

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh] for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

• The [dependabot-cooldown] audit is now aware of GitHub's new three-day default cooldown (#2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛

• Fixed a bug where the [template-injection] audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

• Fixed a bug where the [github-env] audit would incorrectly flag some printf calls as exploitable (#2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

1.27.0

New Features 🌈

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153)

Enhancements 🌱

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛

• Fixed a bug where the [secrets-outside-env] audit would not honor

... (truncated)

Commits

• 4381cc6 Prep zizmor 1.28.0 (#2214)
• 724d0e8 Remove a redundant debug log (#2213)
• 5a01aad [BOT] update JSON schemas from SchemaStore (#2208)
• 6138a6d Add sbt to known Dependabot ecosystems (#2211)
• 23878aa chore(deps): bump the cargo group with 4 updates (#2206)
• 5e839db chore(deps): bump the github-actions group with 3 updates (#2207)
• 297975a dependabot-cooldown: honor GitHub's new default (#2193)
• b648e57 Improve error message on remote ambiguous input refs (#2205)
• d06c823 Dedupe a function in the GitHub APIs (#2204)
• 82f5bf6 github-env: don't flag all-literal printf arguments (#2201)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)