Move artipacked suppressions to zizmor config

The inline `# zizmor: ignore[artipacked]` comment is a second trailing
comment on the checkout line, which prevents Dependabot from updating the
version comment. Suppress these findings in .github/zizmor.yml instead so
the pins stay a single comment and Dependabot keeps them in sync.

.github/workflows/bundled_gems.yml

@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ (github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull')) && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
 

.github/workflows/default_gems_list.yml

@@ -23,7 +23,7 @@ jobs:
     if: ${{ github.repository == 'ruby/ruby' }}
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ (github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull')) && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
 

.github/workflows/post_push.yml

@@ -34,7 +34,7 @@ jobs:
           REDMINE_SYS_API_KEY: ${{ secrets.REDMINE_SYS_API_KEY }}
         if: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/ruby_') }}
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 500 # for notify-slack-commits
           token: ${{ secrets.MATZBOT_AUTO_UPDATE_TOKEN }}

.github/workflows/sync_default_gems.yml

@@ -34,7 +34,7 @@ jobs:
     if: ${{ github.repository == 'ruby/ruby' }}
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         name: Check out ruby/ruby
         with:
           token: ${{ github.repository == 'ruby/ruby' && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}

.github/zizmor.yml

@@ -1,6 +1,13 @@
 # Ignore existing findings (baseline)
 # Composite action findings are suppressed inline with # zizmor: ignore
 rules:
+  artipacked:
+    # These jobs push back to the repo and need persisted credentials.
+    ignore:
+      - bundled_gems.yml
+      - default_gems_list.yml
+      - post_push.yml
+      - sync_default_gems.yml
   dangerous-triggers:
     ignore:
       - auto_request_review.yml