chore: bump zizmor from 1.29.0 to 1.30.0

[dependabot]

Bumps zizmor from 1.29.0 to 1.30.0.

Release notes

Sourced from zizmor's releases.

v1.30.0

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271) Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#2256)

• The forbidden-uses audit now supports pre-commit config inputs (#2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#2272)

• The ref-confusion audit now supports pre-commit config inputs (#2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)

• The archived-uses audit now detects several more archived repositories (#2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)

• Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)

• Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#2300)

• Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#2308)

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.30.0

New Features 🌈

• New audit: [self-repository] detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)

Enhancements 🌱

• The [impostor-commit] audit now supports pre-commit config inputs (#2256)

• The [forbidden-uses] audit now supports pre-commit config inputs (#2263)

• The [adhoc-packages] audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The [archived-uses] audit now supports pre-commit config inputs (#2272)

• The [ref-confusion] audit now supports pre-commit config inputs (#2274)

• The [cache-poisoning] audit now produces more detailed and more precise diagnostics (#2330)

• The [cache-poisoning] audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes @​sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The [unpinned-tools] audit now produces more detailed and more precise diagnostics (#2339)

• The [unpinned-tools] audit now detects usages of @​extractions/setup-just (#2339)

• The [unpinned-tools] audit now detects usages of @​extractions/setup-crate (#2340)

• The [archived-uses] audit now detects several more archived repositories (#2340)

• The [ref-version-mismatch] audit now supports #!yaml uses: that reference reusable workflows (#2344)

• The [stale-action-refs] audit now supports #!yaml uses: that reference reusable workflows (#2345)

Bug Fixes 🐛

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)

... (truncated)

Commits

• fb814d6 Prep 1.30.0 (#2351)
• 3ebc1b1 expressions: add a recursion budget (#2349)
• 3fd0366 zizmor 1.30.0-rc2 (#2347)
• b97ef2a Use Docker's github-builder for image builds (#2346)
• 5510691 stale-action-refs: support reusable workflows (#2345)
• 0c9a307 ref-version-mismatch: support reusable workflows (#2344)
• 3bebccb Bump trophies (#2341)
• 55336ee Suggest tags belonging to the action being used (#2247)
• 5398c76 More archived actions, unpinned-tools (#2340)
• b54e540 unpinned-tools: rewrite in terms of ActionCoordinate (#2339)
• Additional commits viewable in compare view

[codspeed]

Merging this PR will not alter performance

✅ 28 untouched benchmarks

---

_{Comparing dependabot/uv/zizmor-1.30.0 (6e0b155) with main (af787ca)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!