Fix reusable CI workflow container schema for GitHub Actions linting

[Copilot]

The failing Actions job was caused by .github/workflows/continuous-integration.yml using dynamic job-level container fields in a shape that zizmor no longer accepts. The reusable CI workflow now emits schema-compatible container configuration without changing the caller-facing container input contract.

• Container config normalization

  • Convert caller-provided ports and volumes into Docker flags appended to container.options during the prepare job.
  • Keep validation local to the parser so invalid non-array values fail early.

• Schema-compatible job container definition

  • Remove dynamic container.ports and container.volumes from downstream jobs.
  • Replace container.credentials: ${{ fromJSON(...) }} with a normal credentials mapping so workflow schema validation succeeds.

• Targeted workflow audit annotations

  • Add narrow zizmor suppressions only where the reusable workflow intentionally accepts caller-provided images or forwards secrets/tokens.

Example of the effective change:

container:
  image: ${{ needs.prepare.outputs.container-image || '' }}
  env: ${{ fromJSON(needs.prepare.outputs.container-env || '{}') }}
  options: ${{ needs.prepare.outputs.container-options || ' ' }}
  credentials:
    username: ${{ needs.prepare.outputs.container-username || '' }}
    password: ${{ secrets.container-password || '' }}

And in the parser:

container.options = [container.options, ...container.ports.map(port => `--publish ${port}`)]
  .filter(Boolean)
  .join(' ');

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (dependabot/github_actions/github-actions-dependencies-f1ba23a83b@2b80f66). Learn more about missing BASE report.

Additional details and impacted files

@@                                         Coverage Diff                                          @@
##             dependabot/github_actions/github-actions-dependencies-f1ba23a83b      #525   +/-   ##
====================================================================================================
  Coverage                                                                    ?   100.00%           
====================================================================================================
  Files                                                                       ?         1           
  Lines                                                                       ?         3           
  Branches                                                                    ?         0           
====================================================================================================
  Hits                                                                        ?         3           
  Misses                                                                      ?         0           
  Partials                                                                    ?         0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.