fix: add zizmor ignore comments for secrets-outside-env audit rule

Co-authored-by: 2bndy5 <14963867+2bndy5@users.noreply.github.com>

Author: Copilot

.github/workflows/py-coverage.yml

@@ -39,7 +39,7 @@ jobs:
 
       - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         env:
-          CODECOV_TOKEN: ${{secrets.CODECOV_TOKEN}}
+          CODECOV_TOKEN: ${{secrets.CODECOV_TOKEN}} # zizmor: ignore[secrets-outside-env]
         with:
           files: ./coverage.xml
           fail_ci_if_error: true # optional (default = false)

.github/workflows/py-publish.yml

@@ -41,12 +41,12 @@ jobs:
       if: startsWith(github.repository, 'cpp-linter') && !startsWith(github.ref, 'refs/tags/')
       env:
         TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ secrets.TEST_PYPI_TOKEN }}
+        TWINE_PASSWORD: ${{ secrets.TEST_PYPI_TOKEN }} # zizmor: ignore[secrets-outside-env]
       run: twine upload --repository testpypi dist/*
 
     - name: Publish package (to PyPI)
       if: startsWith(github.repository, 'cpp-linter') && startsWith(github.ref, 'refs/tags/')
       env:
         TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
       run: twine upload dist/*

.github/workflows/snyk-container.yml

@@ -17,7 +17,7 @@ jobs:
         # In order to use the Snyk Action you will need to have a Snyk API token.
         # More details in https://github.com/snyk/actions#getting-your-snyk-token
         # or you can sign up for free at https://snyk.io/login
-        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} # zizmor: ignore[secrets-outside-env]
       with:
         image: xianpengshen/clang-tools:all
         args: --severity-threshold=high --file=Dockerfile.all