ci(zizmor): document-ignore intentional adhoc-package installs

[kyle-sexton]

Burn down the note-level zizmor findings that were annotating every PR (all below the fail-on-severity: high gate added in #225).

• ci.yml:404,589 (adhoc-packages): the two exact-pinned npm install -g tsc/biome steps install toolchains on PATH so the contract tests can drive the tools directly — deliberate and documented. Add inline # zizmor: ignore[adhoc-packages] <rationale>.
• publish-packages.yml:83 (use-trusted-publishing): a real security recommendation (drop the long-lived token for OIDC). Left visible and tracked in security(publish-packages): adopt npm OIDC trusted publishing #226 — the proper fix needs npm-org trusted-publisher config.

After this, zizmor --persona=regular reports only the single tracked note.

Related

No related issue: annotation-noise burn-down following the gate rollout (#225, ci-workflows#183). Deferred proper fix tracked in #226.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[claude]

Claude finished @kyle-sexton's task in 59s —— View job

---

Review

• Read changed files and PR context
• Check REVIEW.md criteria
• Analyze annotation correctness and security posture
• Post review

---

Summary: Annotation-only noise-reduction PR. No logic changes. All blocking criteria from REVIEW.md are not applicable here (no auth paths, no secrets, no injection surfaces, no multi-tenancy, no atomicity concerns). The two suppressions are correct and well-justified.

Line 404 — TypeScript install (permalink)

The adhoc-packages finding is suppressed here because the install is:

• Exact-version-pinned via typescript@$TYPESCRIPT_VERSION (resolved from matrix.typescript)
• Required on PATH for the tsconfig contract test to drive tsc directly

The suppression is accurate and the rationale in the comment maps to the real behavior.

Line 589 — Biome + TypeScript install (permalink)

Same pattern: both @biomejs/biome@${BIOME_VERSION} and typescript@${TYPESCRIPT_VERSION} are exact-version-pinned. The comment correctly names both contract tests that depend on this toolchain.

use-trusted-publishing decision

Leaving the publish-packages.yml finding visible and tracking it in #226 is the right call — OIDC trusted publishing is a real recommendation, not annotation noise, and deferring it preserves that signal without creating a false silence.

zizmor ignore syntax

# zizmor: ignore[adhoc-packages] is the correct inline suppression syntax. Both annotations place the comment at the end of the run: line, which is where zizmor expects it for shell-command suppressions.

No findings. Looks good to merge.