[r355] Silence false-positive Zizmor warnings (#12372)

Backport f095c6d from #12364

Co-authored-by: Charles Korn <charleskorn@users.noreply.github.com>

Author: mimir-github-bot[bot]

.github/workflows/compare-helm-with-jsonnet.yml

@@ -29,8 +29,8 @@ jobs:
   goversion:
     runs-on: ubuntu-latest
     needs: prepare
-    container: 
-      image: ${{ needs.prepare.outputs.build_image }}
+    container:
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/generate-docs-helm-tests-renovate-pr.yml

@@ -35,7 +35,7 @@ jobs:
     needs:
       - prepare
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     permissions:
       contents: read
       # The "id-token: write" permission is required by "get-vault-secrets" action. We request it here

.github/workflows/helm-ci.yml

@@ -38,7 +38,7 @@ jobs:
     needs:
       - prepare
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     steps:
       - name: Check out repository
         uses: actions/checkout@v4

.github/workflows/test-build-deploy.yml

@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: prepare
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     steps:
       - uses: actions/checkout@v4
         with:
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: prepare
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -93,7 +93,7 @@ jobs:
     needs:
       - prepare
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -125,7 +125,7 @@ jobs:
     needs:
       - prepare
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -158,7 +158,7 @@ jobs:
     needs:
       - prepare
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -191,7 +191,7 @@ jobs:
     needs:
       - prepare
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -314,7 +314,7 @@ jobs:
     if: needs.prepare.outputs.is_deploy == 'true'
     runs-on: ubuntu-latest
     container:
-      image: ${{ needs.prepare.outputs.build_image }}
+      image: ${{ needs.prepare.outputs.build_image }} # zizmor: ignore[unpinned-images] The image output produced by the prepare step is pinned
     permissions:
       contents: read
       id-token: write