ci: colocate zizmor suppression rationales

Author: opentelemetrybot

.github/workflows/codeql.yml

@@ -58,8 +58,9 @@ jobs:
           # and so it uses more parallelism which uses more memory
           sed -i "s/org.gradle.jvmargs=/org.gradle.jvmargs=-Xmx8g /" gradle.properties
 
-      # zizmor cache-poisoning suppression rationale: this workflow analyzes release branches but does not build or publish release artifacts.
-      - name: Set up Gradle # zizmor: ignore[cache-poisoning]
+      - name: Set up Gradle
+        # zizmor: ignore[cache-poisoning] This workflow analyzes release branches
+        # but does not build or publish release artifacts.
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:

.github/workflows/comment-on-test-label.yml

@@ -12,11 +12,13 @@ name: Comment on test-* label
 # `pull_request_target` would normally expose are not reachable.
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
+  pull_request_target:
+    # zizmor: ignore[dangerous-triggers] No PR code is checked out or executed;
+    # the workflow only posts a comment using trusted workflow code.
     types: [labeled]
 
 permissions:
-  pull-requests: write # zizmor: ignore[excessive-permissions]
+  pull-requests: write # zizmor: ignore[excessive-permissions] Required to post the explanatory PR comment.
 
 jobs:
   comment:

.github/workflows/pr-automation-comments.yml

@@ -1,12 +1,12 @@
 name: PR Automation Comments
 on:
-  # zizmor dangerous-triggers suppression rationale: required to comment on labeled fork PRs;
-  # no PR code is checked out or executed.
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
+  pull_request_target:
+    # zizmor: ignore[dangerous-triggers] Required to comment on labeled fork PRs;
+    # no PR code is checked out or executed.
     types: [labeled]
 
 permissions:
-  pull-requests: write # zizmor: ignore[excessive-permissions]
+  pull-requests: write # zizmor: ignore[excessive-permissions] Required to inspect and create PR comments.
 
 jobs:
   comment-on-breaking-change:

.github/workflows/pr-label-automation.yml

@@ -4,7 +4,7 @@ on:
     types: [created]
 
 permissions:
-  pull-requests: write # zizmor: ignore[excessive-permissions]
+  pull-requests: write # zizmor: ignore[excessive-permissions] Required to add the requested PR label.
 
 jobs:
   auto-label:

.github/workflows/rerun-failed-daily-jobs.yml

@@ -1,9 +1,9 @@
 name: Rerun failed daily jobs
 
 on:
-  # zizmor dangerous-triggers suppression rationale: uses only the trusted default-branch rerun script
-  # and treats the run ID as data.
-  workflow_run: # zizmor: ignore[dangerous-triggers]
+  workflow_run:
+    # zizmor: ignore[dangerous-triggers] Uses only the trusted default-branch rerun
+    # script and treats the run ID as data.
     workflows:
       - "Build (daily)"
       - "Build (daily --no-build-cache)"

.github/workflows/rerun-flaky-pr-jobs.yml

@@ -1,9 +1,9 @@
 name: Rerun flaky PR jobs
 
 on:
-  # zizmor dangerous-triggers suppression rationale: uses only the trusted default-branch rerun script
-  # and treats the run ID as data.
-  workflow_run: # zizmor: ignore[dangerous-triggers]
+  workflow_run:
+    # zizmor: ignore[dangerous-triggers] Uses only the trusted default-branch rerun
+    # script and treats the run ID as data.
     workflows:
       - "Build pull request"
       - "CodeQL"

.github/workflows/survey-on-merged-pr.yml

@@ -1,7 +1,9 @@
 name: Survey on Merged PR by Non-Member
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] — this workflow only calls the reusable shared workflow; no PR code is checked out or executed.
+  pull_request_target:
+    # zizmor: ignore[dangerous-triggers] This only calls the trusted reusable
+    # workflow; no PR code is checked out or executed.
     types: [closed]
     branches: [main]