chore(deps): update dependency zizmor to v1.3.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
zizmor	1.2.1 -> 1.3.1

---

Release Notes

woodruffw/zizmor (zizmor)

v1.3.1

Compare Source

Improvements 🌱🔗

• Passing both --offline and a GitHub token (either implicitly with GH_TOKEN or explicitly with --gh-token) no longer results in an error. --offline is now given precedence, regardless of any other flags or environment settings (#​519)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would fail to parse composite actions with inputs/outputs that are missing descriptions (#​502)
• Expressions that contain indices with non-semantic whitespace are now parsed correctly (#​511)
• Fixed a false positive in [ref-confusion] where partial tag matches were incorrectly considered confusable (#​519)
• Fixed a bug where zizmor would fail to parse workflow definitions with an expression inside strategy.max-parallel (#​522)

v1.3.0

Compare Source

This release comes with one new audit (overprovisioned-secrets), plus a handful of bugfixes and analysis improvements to existing audits. It also comes with a special easter egg for those who wish to kvell about their audit results.

New Features 🌈🔗

• New audit: overprovisioned-secrets detects uses of the secrets context that result in excessive secret provisioning (#​485)
• Added a special naches mode for when you're feeling particularly proud of your audit results (#​490)

Improvements 🌱🔗

• zizmor produces slightly more informative error messages when given an invalid input file (#​482)
• Case insensitivity in contexts is now handeled more consistently and pervasively (#​491)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would fail to discover actions within subdirectories of .github/workflows (#​477)
• Fixed a bug where zizmor would fail to parse composite action definitions with no name field (#​487)

v1.2.2

Compare Source

Bug Fixes 🐛🔗

• The excessive-permissions audit is now more precise about both reusable workflows and reusable workflow calls (#​473)

Improvements 🌱🔗

• Fetch failures when running zizmor org/repo are now more informative (#​475)

---

Configuration

📅 Schedule: Branch creation - "* * * * 0,6" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud