[HereThereBeDragons]

Summary

We triaged the GitHub code-scanning alerts on ROCm/Quartz (zizmor, CodeQL,
and Bandit) and resolved the actionable ones. This clears 6 of the 8 open
alerts and silences the ~857 Bandit B101 findings at their source. The two
remaining open alerts are left intentionally and explained below.

This PR updates the action notify_quartz to version v1.1.3.

Changes

GitHub Actions checkouts (zizmor artipacked)

We set persist-credentials: false on the read-only checkouts so the job token
is no longer written to .git/config and left in the workspace after checkout:

• .github/workflows/unit_tests.yml
• .github/workflows/pre_commit.yml
• .github/workflows/bender.yml
• .github/actions/notify_quartz/action.yml

All four are read-only (clone/fetch, no push), so dropping the persisted
credential has no behavioral effect. bender.yml runs a post-checkout
git fetch origin main develop; since the repository is public, that fetch is
anonymous and continues to work.

Code injection warning (CodeQL)

In notify_quartz/action.yml we moved the runner.os interpreter selection
out of the inline run: expression into an intermediate PYTHON environment
variable, following GitHub's recommended pattern. The resolved command is
unchanged.

Dependabot cooldown (zizmor dependabot-cooldown)

We added a 7-day cooldown to .github/dependabot.yml so a freshly-published
(and possibly compromised or yanked) action version has time to settle before
a bump PR is opened.

Bandit B101 noise

We added an assert_used.skips block to bandit.yml scoped to */tests/* and
*_test.py. assert is pytest's assertion mechanism, so B101 is pure noise
in test files; the skip silences it there while keeping B101 active for
production code, where asserts are stripped under python -O and must not be
used as runtime guards. Verified locally: the test tree drops from 958 B101
findings to 0, while a production assert still flags.

Changelog

Bumped the notify_quartz action to v1.1.3 in
docs/changelogs/notify_quartz.md (security hardening, no interface or
behavior change).

Left intentionally

Two artipacked alerts remain open on the push-capable checkouts:

• .github/workflows/receive_therock_data.yml
• .github/workflows/sync_develop_to_main.yml

These check out with a GitHub App token and rely on the persisted credential to
push back to main/develop. The credential is scoped and under our control,
so we keep it rather than rewire push auth. These should be dismissed in the
code-scanning UI as intentional.

Follow-up

After merge, tag the action release on main: create notify_quartz/v1.1.3
and move notify_quartz/v1 to the same commit.

Test plan

• pre-commit run --files passes on all changed files (actionlint,
  mdformat, YAML checks) -- confirmed locally
• Bandit no longer reports B101 on the test tree with bandit.yml
• unit_tests, pre-commit, and bender workflows pass on this PR
• Confirm the weekly security scan shows 6 fewer open alerts