PSA: 1.0 burndown (and temporary merge freeze on new audits)

[woodruffw]

Hello zizmor users and contributors!

I'm going to start a burn-down on a 1.0 release pretty soon, which means that I want to lock in our current audit list. Consequently, after #294, I'm not planning on merging any more new audits until after a 1.0 release (and after that, each new audit will be semver-signaled with a minor release, e.g. 1.1, 1.2., etc.)

To keep things tractable, here's what's still mergable in the current burndown period:

• QoL/FP/FN improvements to existing audits, e.g. use-trusted-publishing: detect other PyPI uploading tools #282
• General bugfixes (e.g. fixes to the SARIF output or model parsing fixes)
• General performance improvements
• General packaging improvements (e.g. Feature: Add a docker image #135)
• General doc improvements
• Support for auditing composite actions (this is IMO the single biggest thing that needs to be done before 1.0)
• Some kind of MVP static API (this still needs more design thought in Design a static HTTP API for serving pre-computed information #278)

CC @ubiratansoares for viz, since you're by far the most prolific audit contributor!

[woodruffw]

As an update: #331 has landed initial composite action support, and #350 is tracking support for composite actions in various audits (where applicable).

Things appear to be pretty stable in my local testing, so my plan is to do a 1.0 release candidate in the next week or so, followed by a full 1.0 release once #350 is burnt down.

[lishaduck]

FYI, the formatting of the tip in the release notes is a bit off.

[woodruffw]

Thanks -- yeah, that's because GitHub has its own annotation format. I wish they would support the format that the mkdocs ecosystem uses, but it seems like that isn't a priority for them.

I'll fix that later today!