ci(workflows): bump zizmor to 1.32.0 and conform to alpha.32

Author: rdavid

.github/workflows/checkmake.yml

@@ -40,8 +40,8 @@ jobs:
             --location \
             --output ./checkmake \
             --retry 3 \
-            --silent \
             --show-error \
+            --silent \
             "$srv/v$ver/checkmake-v$ver.linux.amd64"
           printf '%s  %s\n' "$sum" ./checkmake | sha256sum --check --status
           chmod +x ./checkmake

.github/workflows/conform.yml

@@ -1,6 +1,6 @@
 # SPDX-FileCopyrightText: 2026 David Rabkin
 # SPDX-License-Identifier: 0BSD
-
+#
 # Enforces the Conventional Commits format required by AGENTS.md. On a pull
 # request every commit ahead of the base branch is checked. conform's
 # --base-branch flag needs the base ref present locally, which fetch-depth 0
@@ -10,7 +10,7 @@
 # master only the last commit is checked. GITHUB_EVENT_NAME and GITHUB_BASE_REF
 # are plain runner environment variables here, not template-expanded strings,
 # so the branching stays free of template injection. conform has no stable
-# release yet, so the pin below tracks the latest alpha.
+# release yet, so the pin below tracks a recent alpha.
 ---
 name: conform
 'on':
@@ -35,8 +35,8 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - run: |
           srv=https://github.com/siderolabs/conform
-          sum=344dd5fad42c61bf739491b490d453943d06f9aaed5488a738c0bbd4588b6914
-          ver=0.1.0-alpha.31
+          sum=b1fb68219577f49216170cc6f56ef9c8286a9a4f4a6a1e02cc5881319be683a4
+          ver=0.1.0-alpha.32
           url=$srv/releases/download/v$ver/conform-linux-amd64
           curl \
             --fail \

.github/workflows/gitleaks.yml

@@ -26,8 +26,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.1
         with:
-          persist-credentials: false
           fetch-depth: 0
+          persist-credentials: false
       - uses: gitleaks/gitleaks-action@v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test-lnx.yml

@@ -8,8 +8,8 @@ name: test-lnx
       - '*.do'
       - .github/workflows/test-lnx.yml
       - app/**
-      - lib/**
       - container/**
+      - lib/**
       - Makefile
   push:
     branches: [master]

.github/workflows/vale.yml

@@ -5,9 +5,9 @@ name: vale
 'on':
   pull_request:
     paths: &paths
-      - .vale.ini
       - .github/styles/**
       - .github/workflows/vale.yml
+      - .vale.ini
       - AGENTS.md
       - README.adoc
   push:

.github/workflows/zizmor.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     env:
-      ver: 1.31.1
+      ver: 1.32.0
     steps:
       - uses: actions/checkout@v7.0.1
         with: