ci: adjust zizmor advanced security handling

[wochinge]

What changed

• Run zizmor-action with advanced-security: false for non-push events, including pull requests and merge queue runs.
• Keep Advanced Security/SARIF uploads enabled on push events.
• Set min-severity: low for the zizmor scan.

Why

Fork pull requests cannot upload code scanning results to GitHub Advanced Security, so requiring zizmor code scanning results blocks community PRs. This keeps the check usable for fork PRs while preserving SARIF upload on trusted pushes.

Validation

• YAML parse check for .github/workflows/zizmor.yml
• git diff --check -- .github/workflows/zizmor.yml

[claude]

LGTM — small CI config tweak that enables zizmor scanning on fork PRs while preserving SARIF upload on trusted push events.

Extended reasoning...

Overview

This PR modifies a single file (.github/workflows/zizmor.yml). It removes the if: guard that skipped zizmor for fork PRs, and conditionally toggles advanced-security based on github.event_name == 'push'. It also sets min-severity: low.

Security risks

None apparent. The change actually broadens security scanning coverage by allowing zizmor to run on fork PRs (previously skipped entirely). Disabling advanced-security for non-push events is the documented workaround for the fact that fork PRs cannot upload SARIF to GitHub Advanced Security — this is a well-known constraint and the appropriate mitigation. Permissions block (permissions: {} at workflow level, security-events: write only at job level) is unchanged. persist-credentials: false on checkout is preserved.

Level of scrutiny

Low. This is a small, mechanical CI config change with clearly stated motivation. The conditional expression ${{ github.event_name == 'push' && 'true' || 'false' }} is a standard GitHub Actions ternary idiom that resolves to a string, which matches the action's advanced-security input type.

Other factors

No prior reviews or comments on this PR. Bug hunting system found no issues. The change is self-contained in a single workflow file and easy to revert if needed.