Bare pin comments: let Dependabot maintain action version comments

[jeremy]

Dependabot rewrites bare # vX.Y.Z comments on pinned uses: lines natively but cannot touch compound ones carrying a trailing # zizmor: ignore[...]. Moving each ignore to its own line directly below the pin (reason text kept, association verified under zizmor 1.28) makes Dependabot itself the comment maintainer — no push automation required on its PRs. Same restructure basecamp-sdk shipped in basecamp-sdk#458. Part of the post-merge redesign of the comment-sync program (see basecamp/.github#10 for why in-PR pushing is unsafe: a deploy-key push flips the run actor off dependabot[bot] and lifts the Dependabot sandbox for the unreviewed bumped actions).

---

Summary by cubic

Let Dependabot maintain action version comments by moving # zizmor: ignore[...] to its own line below each pinned uses: entry. Also update zizmorcore/zizmor-action to v0.6.0 to correctly associate standalone ignores.

• Refactors

  • Move trailing # zizmor: ignore[...] into a standalone line directly under each uses: … # vX.Y.Z.
  • Keeps ignore reasons and avoids push automation on Dependabot PRs.

• Dependencies

  • Bump zizmorcore/zizmor-action to v0.6.0.

^{Written for commit 33c9e08. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/ci.yml
• .github/workflows/release.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

Adjusts GitHub Actions workflow pin comments so Dependabot can natively maintain the # vX.Y.Z “bare pin” comment on uses: lines, while keeping zizmor ignore annotations intact and correctly associated.

Changes:

• Split the compound setup-go pin comment in release.yml into a bare version comment plus a separate zizmor: ignore[...] line directly below it.
• Bump the pinned zizmorcore/zizmor-action SHA (and version comment) in ci.yml to v0.6.0.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release.yml	Makes the setup-go pin comment Dependabot-updatable while preserving the zizmor cache-poisoning ignore rationale.
.github/workflows/ci.yml	Updates the pinned zizmor action SHA/version used for GitHub Actions auditing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}