[claude]

Requested via Slack thread

This workflow change clears the one finding zizmor 1.31 reports for this repo in the org-wide audit. It is an adhoc-packages finding on the npm install hast-util-from-html@^2.0.1 hast-util-select@^6.0.2 step in check-download-links.yml, which is an intentional install for that script, so it is suppressed inline with # zizmor: ignore[adhoc-packages] and the command is unchanged. Nothing else needed fixing.

---

Generated by Claude Code

[claude]

The two red checks on this PR come from existing flaky tests that also fail on main. This PR didn't cause them.

• Coveralls / Check Coverage (job): 3 tests in tests/main/devtools.spec.ts failed with TypeError: vi.mocked(...).mockReturnValue is not a function because the vitest automock of isDevMode wasn't applied. The same tests failed with the same error on main in Coveralls run 38701151626 and in the ubuntu job of CI run 39001231730.
• CI / test / Test (windows-latest, x64) (job): tests/main/electron-types.spec.ts > getElectronTypes({ source: local }) > watches for the types file to be updated failed with Error: Timed out in waitUntil!. The same test failed the same way on main in CI runs 39000403399 and 39001231730.

This PR only adds a # zizmor: ignore[adhoc-packages] YAML comment to .github/workflows/check-download-links.yml, so it can't change test results or coverage. I've re-run the failed jobs once.

---

Generated by Claude Code

[coveralls]

coverage: 87.341%. remained the same — ci/zizmor-audit-fixes into main