Update zizmor

Author: mhsmith

.github/actions/build-android/action.yml

@@ -18,6 +18,8 @@ runs:
     # The steps of a composite action are not clearly divided in the GitHub
     # UI, so use a single step with ::group:: markers instead.
     - shell: bash
+      env:
+        - triplet: ${{ inputs.triplet }}
       run: |
         echo "::group::Configure build Python"
         ./Android/android.py configure-build
@@ -28,18 +30,18 @@ runs:
         echo "::endgroup::"
 
         echo "::group::Configure host Python"
-        ./Android/android.py configure-host ${{ inputs.triplet }}
+        ./Android/android.py configure-host $triplet
         echo "::endgroup::"
 
         echo "::group::Compile host Python"
-        ./Android/android.py make-host ${{ inputs.triplet }}
+        ./Android/android.py make-host $triplet
         echo "::endgroup::"
 
         echo "::group::Make release package"
-        ./Android/android.py package ${{ inputs.triplet }}
+        ./Android/android.py package $triplet
         echo "::endgroup::"
 
-        if [ "$RUNNER_OS" = "Linux" ] && [ "$RUNNER_ARCH" = "X64"]; then
+        if [ "$RUNNER_OS" = "Linux" ] && [ "$RUNNER_ARCH" = "X64" ]; then
             # https://github.blog/changelog/2024-04-02-github-actions-hardware-accelerated-android-virtualization-now-available/
             echo "::group::Enable KVM for Android emulator"
             echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
@@ -50,7 +52,7 @@ runs:
 
             echo "::group::Unpack release artifact"
             mkdir $RUNNER_TEMP/android
-            tar -C $RUNNER_TEMP/android -xf cross-build/${{ inputs.triplet }}/dist/*
+            tar -C $RUNNER_TEMP/android -xf cross-build/$triplet/dist/*
             echo "::endgroup::"
 
             echo "::group::Tests"

.github/workflows/build.yml

@@ -178,8 +178,8 @@ jobs:
       free-threading: ${{ matrix.free-threading }}
 
   build-windows-msi:
-    name: >-  # ${{ '' } is a hack to nest jobs under the same sidebar category
-      Windows MSI${{ '' }}
+    # ${{ '' } is a hack to nest jobs under the same sidebar category.
+    name: Windows MSI${{ '' }}  # zizmor: ignore[obfuscation]
     needs: build-context
     if: fromJSON(needs.build-context.outputs.run-windows-msi)
     strategy:
@@ -612,8 +612,8 @@ jobs:
       run: xvfb-run make ci
 
   build-san:
-    name: >-  # ${{ '' } is a hack to nest jobs under the same sidebar category
-      Sanitizers${{ '' }}
+    # ${{ '' } is a hack to nest jobs under the same sidebar category.
+    name: Sanitizers${{ '' }}  # zizmor: ignore[obfuscation]
     needs: build-context
     if: needs.build-context.outputs.run-tests == 'true'
     strategy:

.pre-commit-config.yaml

@@ -72,11 +72,9 @@ repos:
       - id: actionlint
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.6.0
+    rev: v1.11.0
     hooks:
       - id: zizmor
-        # Action files are misidentified as workflows.
-        exclude: ^.github/actions/
 
   - repo: https://github.com/sphinx-contrib/sphinx-lint
     rev: v1.0.0