[dependabot]

Bumps zizmorcore/zizmor-action from 0.7.1 to 0.8.0.

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.8.0

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version of zizmor or version: prerelease to get whatever latest prerelease the action knows about.

What's Changed

• Support prereleases by @​woodruffw in zizmorcore/zizmor-action#182
• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#184

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

Commits

• 53290ba Sync zizmor versions (#184)
• 76da2ee Support prereleases (#182)
• fb1d87b chore(deps): bump the github-actions group with 2 updates (#180)
• be36601 README: bump pins (#179)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Looks good. This is a routine Dependabot bump of an action that runs in advisory mode only.
What I reviewed:

• The zizmor-action pin moves from v0.7.1 to v0.8.0. It is still pinned to a full commit SHA with a version comment, which matches the other workflow pins.
• The new SHA matches the v0.8.0 head commit named in the PR's release notes. I couldn't fetch the upstream tag from here to confirm it independently.
• Nothing else in the workflow changed: permissions are still deny-by-default with job-level contents: read and actions: read, checkout still uses persist-credentials: false, and the scan step still has continue-on-error: true.

Extended reasoning...

The PR changes one line in .github/workflows/zizmor.yml, updating the SHA and version comment for zizmorcore/zizmor-action. This is CI supply-chain surface, but the bump only moves from one full-SHA pin to another and leaves the job's read-only permissions and credential settings alone. The step is advisory (continue-on-error), so it doesn't gate merges. The repository has no CODEOWNERS file, and the PR timeline shows no reviewer objections. Because it's a small, mechanical change that follows the existing pinning pattern, I approved it.