Build(deps): Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0

[dependabot]

Bumps zizmorcore/zizmor-action from 0.5.7 to 0.6.0.

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

• Fold Docker image pull output into a collapsed Actions log group by @​woodruffw with @​Copilot in zizmorcore/zizmor-action#132
• Readme: document missing inputs by @​staabm in zizmorcore/zizmor-action#130
• ci: block version sync workflow on forks by @​shaanmajid in zizmorcore/zizmor-action#129
• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#137
• Add collect input by @​woodruffw in zizmorcore/zizmor-action#139

New Contributors

• @​woodruffw with @​Copilot made their first contribution in zizmorcore/zizmor-action#132
• @​staabm made their first contribution in zizmorcore/zizmor-action#130
• @​shaanmajid made their first contribution in zizmorcore/zizmor-action#129

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

• 6599ee8 Add collect input (#139)
• bec05c8 Sync zizmor versions (#137)
• cf59549 Add issue templates (#135)
• f72bf17 chore(deps): bump github/codeql-action/upload-sarif (#134)
• b2a6fac ci: block version sync workflow on forks (#129)
• 2d88f44 Readme: document missing inputs (#130)
• d81e276 Fold Docker image pull output into a collapsed Actions log group (#132)
• 8c13c53 chore(deps): bump the github-actions group with 2 updates (#133)
• 2f8e9c6 README: bump versions (#128)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

⏸️ Hold — Bot PR Safety Review

zizmorcore/zizmor-action 0.5.7 → 0.6.0 (github-actions ecosystem, minor version bump)

Axis	Result	Detail
Cooldown	❌ Violated	PR opened 2026-07-22 (today, 0 days old). The 7-day cooldown requires waiting until 2026-07-29. No security advisory claimed in the PR body.
Security	✅ No advisory	No CVE/GHSA referenced in the PR body. v0.6.0 release notes mention only: bundling zizmor 1.27.0, log grouping for Docker output, a new collect input, and dependency bumps — no security fixes.
Risk / blast radius	✅ Low	CI-only change — updates the zizmor.yml workflow SHA pin. No impact on the shipped dagfactory package. Minor version bump with purely additive changes (new input, cleaner log output).
CI gate	✅ Green	All 54 check runs completed successfully: full unit-test and integration-test matrix, Static-Check, zizmor (self-referentially running on this PR), CodeQL, Code-Coverage all pass. PyPI publish skipped as expected. No checks pending or awaiting maintainer authorization.
Tag integrity	⚠️ Unverified	New SHA 6599ee8b7a49aef6a770f63d261d214911a7ce02 is annotated as # v0.6.0 in the diff. The tag-dereference API was unavailable in this run (filtered by integrity policy). A maintainer should verify manually: gh api repos/zizmorcore/zizmor-action/git/ref/tags/v0.6.0 (dereference annotated tag if needed) and confirm the SHA matches before merging.

Recommendation: Wait until 2026-07-29 for the 7-day cooldown to elapse, then verify tag integrity manually before merging. No other concerns.

---

This review comment was generated by an agent. It is advisory only and does not approve or merge the PR. Reviewed on 2026-07-22 16:42 UTC.

[tatiana]

Bot PR review — zizmorcore/zizmor-action 0.5.7 → 0.6.0

Recommendation: ✅ Merge — cooldown honored, tag verified, the Run zizmor gate itself passes on the new version.

Cooldown: honored. v0.6.0 released 2026-07-15, PR opened 07-22 = 7 days.

Security: CI-only security linter, not shipped to users. No known advisories against v0.6.0.

Risk: Low. A 0.5 → 0.6 minor of the linter could surface new findings, but Run zizmor 🌈 ran green on this branch.

Tag integrity: SHA 6599ee8b7a49aef6a770f63d261d214911a7ce02 matches v0.6.0 (lightweight tag).

CI: all green.

---

This review comment was generated by Claude (Claude Code). It is advisory only and does not approve or merge the PR. Reviewed on 2026-07-27 10:27 UTC.