chore(deps): update dependency zizmorcore/zizmor to v1.12.1

[oep-renovate]

This PR contains the following updates:

Package	Update	Change
zizmorcore/zizmor	minor	1.11.0 -> 1.12.1

---

Release Notes

zizmorcore/zizmor (zizmorcore/zizmor)

v1.12.1

Compare Source

Bug Fixes 🐛🔗

• Fixed a bug where the cache-poisoning would incorrectly detect the opposite cases for cache enablement (#​1081)

v1.12.0

Compare Source

New Features 🌈🔗

• New audit: unsound-condition detects if: conditions that inadvertently always evaluate to true (#​1053)

Enhancements 🌱🔗

• The cache-poisoning audit now supports auto-fixes for many findings (#​923)
• The known-vulnerable-actions audit now supports auto-fixes for many findings (#​1019)
• zizmor is now stricter about parsing uses: clauses. In particular, zizmor will no longer accept uses: org/repo without a trailing @ref, as GitHub Actions itself does not accept this syntax (#​1019)
• The use-trusted-publishing audit now detects many more patterns, including cargo publish and other run: blocks that make use of publishing commands directly (#​1042)
• The insecure-commands audit now supports auto-fixes for many findings (#​1045)
• The template-injection audit now detects more action injection sinks (#​1059)

Bug Fixes 🐛🔗

• Fixed a bug where --fix would fail to preserve comments when modifying block-style YAML mappings (#​995)
• Fixed a bug where zizmor would crash when given a GitHub API token with leading or trailing whitespace (#​1027)
• Fixed a bug where template-injection findings in --fix mode would be incorrectly patched when referencing an env.* context (#​1052)
• Fixed a bug where template-injection findings in --fix mode would be patched with shell syntax that didn't match the step's actual shell (#​1064)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[oep-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.