ci(zizmor): deduplicate full-repository scans

[devantler]

🤖 Generated by the Daily AI Engineer

Summary

• route pull-request scanning through the standalone required workflow only
• retain one reusable full scan on non-release main pushes plus the targeted failure fixture
• complete merge-group required-workflow runs through an unconditional zero-permission no-op
• lock the event matrix and privilege boundary with a structural regression test

Why

Actions currently performs three full-repository Zizmor scans per pull request and two per ordinary main push. Removing the redundant advisory lookups reduces self-inflicted GitHub API pressure without reducing the pull-request gate, default-branch SARIF refresh, or failure-mode coverage.

Fixes #639
Part of #514

[github-code-quality]

Code Coverage Overview

Languages: Go, C#

Go / code-coverage/test

The overall coverage remains at 50%, unchanged from the main branch.

C# / code-coverage/dotnet

The overall coverage remains at 100%, unchanged from the main branch.

---

_{Updated July 18, 2026 05:45 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	0.38s
✅ GO	revive	2		0	0	11.29s
✅ REPOSITORY	betterleaks	yes		no	no	0.55s
✅ REPOSITORY	checkov	yes		no	no	19.35s
✅ REPOSITORY	gitleaks	yes		no	no	0.13s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	osv-scanner	yes		no	no	0.55s
✅ REPOSITORY	secretlint	yes		no	no	0.87s
✅ REPOSITORY	syft	yes		no	no	3.37s
✅ REPOSITORY	trivy	yes		no	no	13.04s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.13s
✅ REPOSITORY	trufflehog	yes		no	no	4.83s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters COPYPASTE_JSCPD,GO_REVIVE,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Daily AI Engineer

Readiness evidence at head 6df8f58: exercised the pull-request workflow as its consumer. The standalone required-workflow zizmor job completed successfully; CI's [Test] Zizmor - Default Settings reusable full scan was skipped; [Test] Zizmor - Blocks On Vulnerable Fixture, [Test] Zizmor - Gate Pins Self-Tested Action, lint-ci-coverage-parity, and CI - Required Checks all passed. This is the intended one-scan PR route with the failure-mode and lockstep guards retained.

Local validation also passed every .github/tests/*.sh test, ShellCheck, shfmt, yamllint, Zizmor, and diff hygiene. Actionlint reports only the same four existing code-quality scope diagnostics on the two changed workflows as origin/main (no new diagnostic). The new routing guard was mutation-tested: emitting scan=false and adding if: false to the eligibility job each produced the expected RED before the correct form was restored.

The merge-group path cannot be generated from a draft PR; its zero-permission successful no-op and exact-true privilege gate are covered structurally. The actual PR route has been observed and judged correct. Exact-head Codex review is still processing, so this remains draft.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 6df8f58f7a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".