chore: workflow hardening — pinact + zizmor [automated]

[infra-hardening]

Automated workflow hardening

This PR was generated by the pt-infra-hardening pipeline.

Changes

.github/workflows/frogbot.yml — marker

• Added inert marker comment to carry the "Needs human attention" section (no mechanical fixes were applicable).

⚠️ Needs human attention

These findings could not be fixed automatically and need a maintainer's decision:

• .github/workflows/frogbot.yml:3 — dangerous-triggers: pull_request_target is almost always used insecurely; a human needs to evaluate whether this trigger is necessary and, if so, ensure it is used safely (e.g. restrict to read-only permissions, avoid checking out untrusted code). → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/frogbot.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

  Replace <rule-name> with the rule id without the zizmor/ prefix (e.g. secrets-inherit).

---

Suppressing findings

To prevent a finding from being flagged in future hardening runs — whether it was fixed automatically or flagged for manual review — add an inline comment on the relevant line:

# zizmor: ignore[<rule-name>] <your reason here>

Replace <rule-name> with the audit name (e.g. artipacked, secrets-inherit). See zizmor audit docs for all rule names.