chore(mise): Update tool zizmor (1.26.1 → 1.28.0)

[home-infrastructure-renovate]

This PR contains the following updates:

Package	Update	Change
zizmor	minor	1.26.1 → 1.28.0

---

Release Notes

zizmorcore/zizmor (zizmor)

v1.28.0

Compare Source

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#​2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#​2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#​2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps..outcome and steps..conclusion as injection risks in the default persona (#​2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#​2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#​2205)

v1.27.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#​2153)
  Enhancements 🌱🔗

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#​2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#​2180)

Bug Fixes 🐛🔗

• Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#​2157)

• Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#​2177)

• Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#​2185)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[home-infrastructure-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands