Update Zizmor to 1.30.1

[Bret Comnes (bcomnes)]

LLM Description written by Codex:GPT-6

Summary

Update the shared GitHub Actions audit from Zizmor 1.23.1 to 1.30.1.

Zizmor 1.23.1 incorrectly reports empty matrix service-image values as unpinned images. GitHub Actions explicitly supports empty images to disable optional services. This produces 24 false positives blocking https://github.com/SocketDev/depscan/pull/26700.

The upstream fix shipped in 1.26.0: zizmorcore/zizmor#2102. Version 1.30.1 includes that fix.

Validation

• Zizmor 1.30.1 offline audit of this repository .github: no findings (one suppressed).
• Zizmor 1.30.1 offline audit of the affected depscan pull-request workflow: no unpinned-images findings. Other audit findings remain; this does not claim a fully passing depscan audit.
• git diff --check passes.

Rollout

The required workflow is consumed from this repository master by enterprise rulesets, so merging updates the audit across consuming repositories. Newer audits may expose additional findings; this change does not disable or suppress them.

---

Note

Low Risk
Single dependency pin in a read-only CI audit job; no application or auth logic changes.

Overview
Bumps the Audit GitHub Actions workflow’s pinned zizmor package from 1.23.1 to 1.30.1 in the install step.

The upgrade picks up upstream fixes (including handling of empty matrix service-image values) so the shared audit stops reporting false unpinned-images findings on valid workflows. Because this workflow is reused via rulesets, merging updates the audit version for consuming repos; newer zizmor may surface additional real findings.

^{Reviewed by Cursor Bugbot for commit cfca7f0. Configure here.}