ci: ignore specific shellcheck warnings in generated release workflow

Suppress SC2086 and SC2129 linting errors for the generated release.yml to prevent build noise while maintaining checks for logic issues.

.github/workflows/actions-security.yml

@@ -28,8 +28,13 @@ jobs:
           persist-credentials: false
 
       - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.
-
+        with:
+          # release.yml is generated by dist. Keep linting it for real
+          # workflow issues, but ignore generated ShellCheck style/info noise.
+          flags: >-
+            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2086'
+            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2129'
   zizmor:
     name: zizmor
     runs-on: ubuntu-latest

.github/workflows/supply-chain.yml

@@ -62,3 +62,9 @@ jobs:
 
       - name: Run actionlint
         uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2
+        with:
+          # release.yml is generated by dist. Keep linting it for real
+          # workflow issues, but ignore generated ShellCheck style/info noise.
+          flags: >-
+            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2086'
+            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2129'