fix some zizmor warnings

20 files changed, 220 insertions, 163 deletions

diff --git a/.github/actions/build-boost/action.yml b/.github/actions/build-boost/action.yml
index 71154b7..2c6f446 100644
--- a/.github/actions/build-boost/action.yml
+++ b/.github/actions/build-boost/action.yml
@@ -22,15 +22,21 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
+    - env:
+        ARG_BOOST_DIR: ${{ inputs.boost-dir }}
+        ARG_LIBRARIES: ${{ inputs.libraries }}
+        ARG_TOOLSET: ${{ inputs.toolset }}
+        ARG_PLATFORM: ${{ inputs.platform }}
+        ARG_CONFIGURATION: ${{ inputs.configuration }}
+      run: |
         $python = 'python'
 
-        $boost_dir = '${{ inputs.boost-dir }}'
+        $boost_dir = $env:ARG_BOOST_DIR
         if (-not $boost_dir) {
             $boost_dir = $env:BOOST_DIR
         }
 
-        $libraries = '${{ inputs.libraries }}'
+        $libraries = $env:ARG_LIBRARIES
         $libraries = $libraries.Split(' ')
         if (-not $libraries) {
             Remove-Variable libraries
@@ -38,9 +44,9 @@ runs:
 
         & $python `
             -m project.boost.build `
-            --toolset '${{ inputs.toolset }}' `
-            --platform '${{ inputs.platform }}' `
-            --configuration '${{ inputs.configuration }}' `
+            --toolset $env:ARG_TOOLSET `
+            --platform $env:ARG_PLATFORM `
+            --configuration $env:ARG_CONFIGURATION `
             -- `
             $boost_dir `
             $libraries
diff --git a/.github/actions/build-example/action.yml b/.github/actions/build-example/action.yml
index 9909398..cd49c28 100644
--- a/.github/actions/build-example/action.yml
+++ b/.github/actions/build-example/action.yml
@@ -22,32 +22,41 @@ inputs:
 outputs:
   install-dir:
     description: Installation directory
-    value: '${{ steps.install-dir.outputs.path }}'
+    value: ${{ steps.install-dir.outputs.path }}
 runs:
   using: composite
   steps:
     - id: install-dir
+      env:
+        ARG_SRC_DIR: ${{ inputs.src-dir }}
       run: |
-        $src_dir = Resolve-Path '${{ inputs.src-dir }}'
+        $src_dir = Resolve-Path $env:ARG_SRC_DIR
         $project_name = Split-Path $src_dir -Leaf
         $install_dir = Join-Path (Split-Path $env:GITHUB_WORKSPACE) "install_$project_name"
         echo "path=$install_dir" >> $env:GITHUB_OUTPUT
       shell: pwsh
-    - run: |
+    - env:
+        ARG_SRC_DIR: ${{ inputs.src-dir }}
+        ARG_BOOST_DIR: ${{ inputs.boost-dir }}
+        ARG_TOOLSET: ${{ inputs.toolset }}
+        ARG_PLATFORM: ${{ inputs.platform }}
+        ARG_CONFIGURATION: ${{ inputs.configuration }}
+        INSTALL_DIR: ${{ steps.install-dir.outputs.path }}
+      run: |
         $python = 'python'
-        $src_dir = '${{ inputs.src-dir }}'
-        $install_dir = '${{ steps.install-dir.outputs.path }}'
-        $boost_dir = '${{ inputs.boost-dir }}'
+        $src_dir = $env:ARG_SRC_DIR
+        $install_dir = $env:INSTALL_DIR
+        $boost_dir = $env:ARG_BOOST_DIR
 
         $args = @(
             '--install',
             $install_dir,
             '--platform',
-            '${{ inputs.platform }}',
+            $env:ARG_PLATFORM,
             '--configuration',
-            '${{ inputs.configuration }}',
+            $env:ARG_CONFIGURATION,
             '--toolset',
-            '${{ inputs.toolset }}'
+            $env:ARG_TOOLSET
         )
 
         if ($boost_dir) {
diff --git a/.github/actions/check-arch/action.yml b/.github/actions/check-arch/action.yml
index b8e4d64..3dce1d1 100644
--- a/.github/actions/check-arch/action.yml
+++ b/.github/actions/check-arch/action.yml
@@ -10,14 +10,17 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
+    - env:
+        ARG_PATH: ${{ inputs.path }}
+        ARG_EXPECTED: ${{ inputs.expected }}
+      run: |
         $script_path = if ($env:CI_TARGET_PE) {
             Join-Path $env:GITHUB_WORKSPACE 'test' 'scripts' 'verify_arch.ps1'
         } else {
             Join-Path $env:GITHUB_WORKSPACE 'test' 'scripts' 'verify_arch.sh'
         }
 
-        $exe_path = (Join-Path '${{ inputs.path }}' 'bin' 'foo') + $env:CI_EXE_EXT
+        $exe_path = (Join-Path $env:ARG_PATH 'bin' 'foo') + $env:CI_EXE_EXT
 
-        & $script_path $exe_path '${{ inputs.expected }}'
+        & $script_path $exe_path $env:ARG_EXPECTED
       shell: pwsh
diff --git a/.github/actions/check-boost-libraries/action.yml b/.github/actions/check-boost-libraries/action.yml
index e41e028..58d9f49 100644
--- a/.github/actions/check-boost-libraries/action.yml
+++ b/.github/actions/check-boost-libraries/action.yml
@@ -18,19 +18,21 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
-        $boost_dir = '${{ inputs.boost-dir }}'
+    - env:
+        ARG_BOOST_DIR: ${{ inputs.boost-dir }}
+        ARG_LIBRARIES: ${{ inputs.libraries }}
+        ARG_PLATFORM: ${{ inputs.platform }}
+        ARG_CONFIGURATION: ${{ inputs.configuration }}
+      run: |
+        $boost_dir = $env:ARG_BOOST_DIR
         if (-not $boost_dir) {
             $boost_dir = $env:BOOST_DIR
         }
 
-        $libraries = '${{ inputs.libraries }}'
-        $libraries = $libraries.Split(' ')
+        $libraries = $env:ARG_LIBRARIES.Split(' ')
+        $configuration = $env:ARG_CONFIGURATION.ToLower()
 
-        $configuration = '${{ inputs.configuration }}'
-        $configuration = $configuration.ToLower()
-
-        $installdir = Join-Path 'install_dir' '${{ inputs.platform }}' $configuration
+        $installdir = Join-Path 'install_dir' $env:ARG_PLATFORM $configuration
         $librarydir = Join-Path $boost_dir $installdir 'lib'
 
         function Get-FileStubs {
diff --git a/.github/actions/check-runtime-library/action.yml b/.github/actions/check-runtime-library/action.yml
index a112687..be4823d 100644
--- a/.github/actions/check-runtime-library/action.yml
+++ b/.github/actions/check-runtime-library/action.yml
@@ -7,8 +7,10 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
-        New-Variable path -Value '${{ inputs.path }}' -Option Constant
+    - env:
+        ARG_PATH: ${{ inputs.path }}
+      run: |
+        $path = $env:ARG_PATH
 
         function Parse-DllLine {
             param(
diff --git a/.github/actions/check-symbols/action.yml b/.github/actions/check-symbols/action.yml
index 3681f52..50a6843 100644
--- a/.github/actions/check-symbols/action.yml
+++ b/.github/actions/check-symbols/action.yml
@@ -10,8 +10,11 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
-        $install_dir = '${{ inputs.path }}'
+    - env:
+        ARG_PATH: ${{ inputs.path }}
+        ARG_EXPECTED: ${{ inputs.expected }}
+      run: |
+        $install_dir = $env:ARG_PATH
         $bin_dir = Join-Path $install_dir 'bin'
         $lib_dir = Join-Path $install_dir 'lib'
 
@@ -21,7 +24,7 @@ runs:
             throw "Verifying symbols for PE executables is not implemented"
         }
 
-        ConvertFrom-Json '${{ inputs.expected }}' | %{
+        ConvertFrom-Json $env:ARG_EXPECTED | %{
             $target = $_.target
             $type = $_.type
 
diff --git a/.github/actions/common-variables/action.yml b/.github/actions/common-variables/action.yml
index 3b197da..af86aff 100644
--- a/.github/actions/common-variables/action.yml
+++ b/.github/actions/common-variables/action.yml
@@ -7,21 +7,21 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
-        New-Variable toolset -Value '${{ inputs.toolset }}' -Option Constant
+    - env:
+        ARG_TOOLSET: ${{ inputs.toolset }}
+      run: |
+        $toolset = $env:ARG_TOOLSET
 
-        New-Variable os -Value '${{ runner.os }}' -Option Constant
+        $host_linux = '${{ runner.os }}' -eq 'Linux'
+        $host_windows = '${{ runner.os }}' -eq 'Windows'
 
-        New-Variable host_linux -Value ($os -eq 'Linux') -Option Constant
-        New-Variable host_windows -Value ($os -eq 'Windows') -Option Constant
+        $mingw = $toolset -eq 'mingw' -or ($host_windows -and $toolset -eq 'gcc')
 
-        New-Variable mingw -Value ($toolset -eq 'mingw' -or ($host_windows -and $toolset -eq 'gcc')) -Option Constant
+        $target_linux = $host_linux -and !$mingw
+        $target_windows = $mingw -or $host_windows
 
-        New-Variable target_linux -Value ($host_linux -and !$mingw) -Option Constant
-        New-Variable target_windows -Value ($mingw -or $host_windows) -Option Constant
-
-        New-Variable target_pe -Value $target_windows -Option Constant
-        New-Variable target_elf -Value $target_linux -Option Constant
+        $target_pe = $target_windows
+        $target_elf = $target_linux
 
         function Set-BoolVar {
             param(
diff --git a/.github/actions/download-boost/action.yml b/.github/actions/download-boost/action.yml
index 05f6bf3..2fea082 100644
--- a/.github/actions/download-boost/action.yml
+++ b/.github/actions/download-boost/action.yml
@@ -11,7 +11,9 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: echo 'BOOST_VERSION=${{ inputs.boost-version }}' >> $env:GITHUB_ENV
+    - env:
+        ARG_BOOST_VERSION: ${{ inputs.boost-version }}
+      run: echo "BOOST_VERSION=$env:ARG_BOOST_VERSION" >> $env:GITHUB_ENV
       shell: pwsh
     - run: |
         $parent_dir = Split-Path $env:GITHUB_WORKSPACE
@@ -23,7 +25,9 @@ runs:
         $dir = Join-Path $env:BOOST_CACHE_DIR $dir_name
         echo "BOOST_DIR=$dir" >> $env:GITHUB_ENV
       shell: pwsh
-    - run: |
+    - env:
+        ARG_NO_RETRY: ${{ inputs.no-retry }}
+      run: |
         echo ''
         echo '----------------------------------------------------------------'
         echo "BOOST_VERSION:   $env:BOOST_VERSION"
@@ -35,7 +39,7 @@ runs:
         $python = 'python'
         $cache_dir = $env:BOOST_CACHE_DIR
 
-        $no_retry = '${{ inputs.no-retry }}' -eq '1'
+        $no_retry = $env:ARG_NO_RETRY -eq '1'
 
         $args = @()
         if ($no_retry) {
diff --git a/.github/actions/run-example-boost/action.yml b/.github/actions/run-example-boost/action.yml
index 0fd05ed..c2933f1 100644
--- a/.github/actions/run-example-boost/action.yml
+++ b/.github/actions/run-example-boost/action.yml
@@ -7,8 +7,10 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
-        New-Variable path -Value '${{ inputs.path }}' -Option Constant
+    - env:
+        ARG_PATH: ${{ inputs.path }}
+      run: |
+        $path = $env:ARG_PATH
 
         if ($env:CI_HOST_LINUX -and -not $env:CI_TARGET_LINUX) {
             echo 'Not going to do that on Linux/MinGW'
diff --git a/.github/actions/run-example/action.yml b/.github/actions/run-example/action.yml
index 5300ab9..9d3f90f 100644
--- a/.github/actions/run-example/action.yml
+++ b/.github/actions/run-example/action.yml
@@ -7,8 +7,10 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
-        New-Variable path -Value '${{ inputs.path }}' -Option Constant
+    - env:
+        ARG_PATH: ${{ inputs.path }}
+      run: |
+        $path = $env:ARG_PATH
 
         if ($env:CI_HOST_LINUX -and -not $env:CI_TARGET_LINUX) {
             echo 'Not going to do that on Linux/MinGW'
diff --git a/.github/actions/software-environment/action.yml b/.github/actions/software-environment/action.yml
index 9dd1486..25d3ce5 100644
--- a/.github/actions/software-environment/action.yml
+++ b/.github/actions/software-environment/action.yml
@@ -1,13 +1,5 @@
 name: Set up software environment
 description: Set up software paths and versions
-inputs:
-  toolset:
-    description: Toolset to use
-    required: true
-  platform:
-    description: Target platform
-    required: false
-    default: x64
 runs:
   using: composite
   steps:
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ca79ca5..9cbb9b7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,5 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/aur.yml b/.github/workflows/aur.yml
index 83caa62..efb5481 100644
--- a/.github/workflows/aur.yml
+++ b/.github/workflows/aur.yml
@@ -4,6 +4,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   publish:
     name: Publish to AUR
@@ -11,8 +13,7 @@ jobs:
     container:
       image: archlinux:base-devel
       env:
-        SSH_KEY: |
-          ${{ secrets.SSH_KEY }}
+        SSH_KEY: ${{ secrets.SSH_KEY }}
     steps:
       # This step must be done before actions/checkout. From the latter's
       # output:
@@ -25,8 +26,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           ref: aur
-          token: '${{ secrets.GH_TOKEN }}'
+          token: ${{ secrets.GH_TOKEN }}
       - name: Run maintenance
         run: |
           make -C "$GITHUB_WORKSPACE" ci
diff --git a/.github/workflows/basic.yml b/.github/workflows/basic.yml
index 8d2bc1e..6c3be3e 100644
--- a/.github/workflows/basic.yml
+++ b/.github/workflows/basic.yml
@@ -4,6 +4,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   # Check that the most basic use-case works on different OSs.
   os:
@@ -19,7 +21,7 @@ jobs:
           - macos-26
         include:
           - boost-version: 1.91.0
-    runs-on: '${{ matrix.os }}'
+    runs-on: ${{ matrix.os }}
     name: 'Image: ${{ matrix.os }}'
     defaults:
       run:
@@ -27,6 +29,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
@@ -68,6 +72,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
diff --git a/.github/workflows/boost_download.yml b/.github/workflows/boost_download.yml
index ea928da..dfb397b 100644
--- a/.github/workflows/boost_download.yml
+++ b/.github/workflows/boost_download.yml
@@ -4,6 +4,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
     strategy:
@@ -18,14 +20,16 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
           python-version: '3.x'
       - name: Download Boost
-        uses: ./.github/actions/download-boost
+        uses: $/.github/actions/download-boost
         with:
-          boost-version: '${{ matrix.boost-version }}'
+          boost-version: ${{ matrix.boost-version }}
           no-retry: 1
       - name: Check that Boost was downloaded
-        uses: ./.github/actions/check-boost-download
+        uses: $/.github/actions/check-boost-download
diff --git a/.github/workflows/boost_toolsets.yml b/.github/workflows/boost_toolsets.yml
index 8d2b878..924e3d7 100644
--- a/.github/workflows/boost_toolsets.yml
+++ b/.github/workflows/boost_toolsets.yml
@@ -4,6 +4,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
     strategy:
@@ -55,9 +57,9 @@ jobs:
           - {os: windows-2025, boost-version: 1.72.0}
           - {os: windows-2025, boost-version: 1.82.0}
 
-    runs-on: '${{ matrix.os }}'
+    runs-on: ${{ matrix.os }}
 
-    name: '${{ matrix.boost-version }} / ${{ matrix.toolset }} / ${{ matrix.name }}'
+    name: ${{ matrix.boost-version }} / ${{ matrix.toolset }} / ${{ matrix.name }}
 
     # 1) VS 2022 isn't supported by older Boost versions.  It just doesn't
     #    work, the errors are numerous.
@@ -74,6 +76,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Cache Boost
         uses: actions/cache@v6
@@ -86,9 +90,9 @@ jobs:
         if: runner.os == 'Windows'
 
       - name: Set common variables
-        uses: ./.github/actions/common-variables
+        uses: $/.github/actions/common-variables
         with:
-          toolset: '${{ matrix.toolset }}'
+          toolset: ${{ matrix.toolset }}
 
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -98,80 +102,80 @@ jobs:
       - name: Install GCC
         uses: egor-tensin/setup-gcc@v2
         with:
-          platform: '${{ matrix.platform }}'
+          platform: ${{ matrix.platform }}
         if: env.CI_HOST_LINUX && (matrix.toolset == 'auto' || matrix.toolset == 'gcc')
 
       - name: Install Clang
         uses: egor-tensin/setup-clang@v2
         with:
-          platform: '${{ matrix.platform }}'
+          platform: ${{ matrix.platform }}
         if: matrix.toolset == 'clang' || matrix.toolset == 'clang-cl'
 
       - name: Install MinGW
         uses: egor-tensin/setup-mingw@v3
         with:
-          platform: '${{ matrix.platform }}'
+          platform: ${{ matrix.platform }}
         # toolset == 'clang' needs some kind of make, e.g. mingw32-make:
         if: env.CI_MINGW || (matrix.toolset == 'clang' && env.CI_HOST_WINDOWS)
 
       - name: Set up software environment
-        uses: ./.github/actions/software-environment
+        uses: $/.github/actions/software-environment
         with:
-          toolset: '${{ matrix.toolset }}'
-          platform: '${{ matrix.platform }}'
+          toolset: ${{ matrix.toolset }}
+          platform: ${{ matrix.platform }}
 
       - name: Set up Visual Studio
         uses: egor-tensin/vs-shell@v2
         with:
-          arch: '${{ matrix.platform }}'
+          arch: ${{ matrix.platform }}
         if: matrix.toolset == 'clang-cl' && env.CI_HOST_WINDOWS
 
       - name: Download Boost
-        uses: ./.github/actions/download-boost
+        uses: $/.github/actions/download-boost
         with:
-          boost-version: '${{ matrix.boost-version }}'
+          boost-version: ${{ matrix.boost-version }}
 
       - name: Build Boost
-        uses: ./.github/actions/build-boost
+        uses: $/.github/actions/build-boost
         with:
-          toolset: '${{ matrix.toolset }}'
-          libraries: '${{ matrix.libraries }}'
-          platform: '${{ matrix.platform }}'
-          configuration: '${{ matrix.configuration }}'
+          toolset: ${{ matrix.toolset }}
+          libraries: ${{ matrix.libraries }}
+          platform: ${{ matrix.platform }}
+          configuration: ${{ matrix.configuration }}
         continue-on-error: true
 
       - name: Check that Boost was bootstrapped
-        uses: ./.github/actions/check-boost-bootstrapped
+        uses: $/.github/actions/check-boost-bootstrapped
 
       - name: Check that Boost libraries were built
-        uses: ./.github/actions/check-boost-libraries
+        uses: $/.github/actions/check-boost-libraries
         with:
-          libraries: '${{ matrix.libraries }}'
-          platform: '${{ matrix.platform }}'
-          configuration: '${{ matrix.configuration }}'
+          libraries: ${{ matrix.libraries }}
+          platform: ${{ matrix.platform }}
+          configuration: ${{ matrix.configuration }}
 
       - name: Build examples/boost
         id: build_example
-        uses: ./.github/actions/build-example
+        uses: $/.github/actions/build-example
         with:
           src-dir: test/examples/boost
-          boost-dir: '${{ env.BOOST_DIR }}'
-          toolset: '${{ matrix.toolset }}'
-          platform: '${{ matrix.platform }}'
-          configuration: '${{ matrix.configuration }}'
+          boost-dir: ${{ env.BOOST_DIR }}
+          toolset: ${{ matrix.toolset }}
+          platform: ${{ matrix.platform }}
+          configuration: ${{ matrix.configuration }}
 
       - name: Verify runtime library linkage
-        uses: ./.github/actions/check-runtime-library
+        uses: $/.github/actions/check-runtime-library
         with:
-          path: '${{ steps.build_example.outputs.install-dir }}'
+          path: ${{ steps.build_example.outputs.install-dir }}
 
       - name: Verify architecture
-        uses: ./.github/actions/check-arch
+        uses: $/.github/actions/check-arch
         with:
-          path: '${{ steps.build_example.outputs.install-dir }}'
-          expected: '${{ matrix.platform }}'
+          path: ${{ steps.build_example.outputs.install-dir }}
+          expected: ${{ matrix.platform }}
 
       - name: Run examples/boost
-        uses: ./.github/actions/run-example-boost
+        uses: $/.github/actions/run-example-boost
         with:
-          path: '${{ steps.build_example.outputs.install-dir }}'
+          path: ${{ steps.build_example.outputs.install-dir }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ceb15d1..35f7453 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,30 +10,32 @@ on:
     - cron: '30 01 * * 5'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   lint:
     name: Linting
-    uses: ./.github/workflows/lint.yml
+    uses: $/.github/workflows/lint.yml
 
   basic:
     name: Basic usage
-    uses: ./.github/workflows/basic.yml
+    uses: $/.github/workflows/basic.yml
 
   boost_download:
     name: Boost (download)
-    uses: ./.github/workflows/boost_download.yml
+    uses: $/.github/workflows/boost_download.yml
 
   boost_toolsets:
     name: Boost (toolsets)
-    uses: ./.github/workflows/boost_toolsets.yml
+    uses: $/.github/workflows/boost_toolsets.yml
 
   example_toolsets:
     name: Examples (toolsets)
-    uses: ./.github/workflows/example_toolsets.yml
+    uses: $/.github/workflows/example_toolsets.yml
 
   msvc_versions:
     name: Visual Studio versions
-    uses: ./.github/workflows/msvc_versions.yml
+    uses: $/.github/workflows/msvc_versions.yml
 
   # Build a Python package and upload to PyPI.
   publish:
@@ -51,6 +53,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
@@ -72,12 +75,12 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           user: __token__
-          password: '${{ secrets.PYPI_API_TOKEN }}'
+          password: ${{ secrets.PYPI_API_TOKEN }}
 
   aur:
     name: Publish to AUR
     needs:
       - publish
     if: startsWith(github.ref, 'refs/tags/')
-    uses: ./.github/workflows/aur.yml
+    uses: $/.github/workflows/aur.yml
     secrets: inherit
diff --git a/.github/workflows/example_toolsets.yml b/.github/workflows/example_toolsets.yml
index f2b083c..ad294d6 100644
--- a/.github/workflows/example_toolsets.yml
+++ b/.github/workflows/example_toolsets.yml
@@ -4,6 +4,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
     strategy:
@@ -64,22 +66,24 @@ jobs:
           - {os: ubuntu-latest, toolset: msvc}
           - {os: ubuntu-latest, toolset: clang-cl}
 
-    runs-on: '${{ matrix.os }}'
+    runs-on: ${{ matrix.os }}
 
-    name: '${{ matrix.toolset }} / ${{ matrix.name }}'
+    name: ${{ matrix.toolset }} / ${{ matrix.name }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Clean up PATH
         uses: egor-tensin/cleanup-path@v5
         if: runner.os == 'Windows'
 
       - name: Set common variables
-        uses: ./.github/actions/common-variables
+        uses: $/.github/actions/common-variables
         with:
-          toolset: '${{ matrix.toolset }}'
+          toolset: ${{ matrix.toolset }}
 
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -89,62 +93,62 @@ jobs:
       - name: Install GCC
         uses: egor-tensin/setup-gcc@v2
         with:
-          platform: '${{ matrix.platform }}'
+          platform: ${{ matrix.platform }}
         if: env.CI_HOST_LINUX && (matrix.toolset == 'auto' || matrix.toolset == 'gcc')
 
       - name: Install Clang
         uses: egor-tensin/setup-clang@v2
         with:
-          platform: '${{ matrix.platform }}'
+          platform: ${{ matrix.platform }}
         if: matrix.toolset == 'clang' || matrix.toolset == 'clang-cl'
 
       - name: Install MinGW
         uses: egor-tensin/setup-mingw@v3
         with:
-          platform: '${{ matrix.platform }}'
+          platform: ${{ matrix.platform }}
         # toolset == 'clang' needs some kind of make, e.g. mingw32-make:
         if: env.CI_MINGW || (matrix.toolset == 'clang' && env.CI_HOST_WINDOWS)
 
       - name: Set up software environment
-        uses: ./.github/actions/software-environment
+        uses: $/.github/actions/software-environment
         with:
-          toolset: '${{ matrix.toolset }}'
-          platform: '${{ matrix.platform }}'
+          toolset: ${{ matrix.toolset }}
+          platform: ${{ matrix.platform }}
 
       - name: Set up Visual Studio
         uses: egor-tensin/vs-shell@v2
         with:
-          arch: '${{ matrix.platform }}'
+          arch: ${{ matrix.platform }}
         if: matrix.toolset == 'clang-cl' && env.CI_HOST_WINDOWS
 
       - name: Build example project
         id: build
-        uses: ./.github/actions/build-example
+        uses: $/.github/actions/build-example
         with:
           src-dir: 'test/examples/${{ matrix.example }}'
-          toolset: '${{ matrix.toolset }}'
-          platform: '${{ matrix.platform }}'
-          configuration: '${{ matrix.configuration }}'
+          toolset: ${{ matrix.toolset }}
+          platform: ${{ matrix.platform }}
+          configuration: ${{ matrix.configuration }}
 
       - name: Verify runtime library linkage
-        uses: ./.github/actions/check-runtime-library
+        uses: $/.github/actions/check-runtime-library
         with:
-          path: '${{ steps.build.outputs.install-dir }}'
+          path: ${{ steps.build.outputs.install-dir }}
 
       - name: Verify architecture
-        uses: ./.github/actions/check-arch
+        uses: $/.github/actions/check-arch
         with:
-          path: '${{ steps.build.outputs.install-dir }}'
-          expected: '${{ matrix.platform }}'
+          path: ${{ steps.build.outputs.install-dir }}
+          expected: ${{ matrix.platform }}
 
       - name: Run example project
-        uses: ./.github/actions/run-example
+        uses: $/.github/actions/run-example
         with:
-          path: '${{ steps.build.outputs.install-dir }}'
+          path: ${{ steps.build.outputs.install-dir }}
 
       #- name: Check symbols
-      #  uses: ./.github/actions/check-symbols
+      #  uses: $/.github/actions/check-symbols
       #  with:
-      #    path: '${{ steps.build.outputs.install-dir }}'
-      #    expected: '${{ toJson(matrix.symbols) }}'
+      #    path: ${{ steps.build.outputs.install-dir }}
+      #    expected: ${{ toJson(matrix.symbols) }}
       #  if: env.CI_TARGET_ELF
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 5566327..ad838b6 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,6 +4,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   # Check that project.format works (and the C/C++ files are formatted).
   lint:
@@ -13,6 +15,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
diff --git a/.github/workflows/msvc_versions.yml b/.github/workflows/msvc_versions.yml
index d8060e7..04c7307 100644
--- a/.github/workflows/msvc_versions.yml
+++ b/.github/workflows/msvc_versions.yml
@@ -4,6 +4,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
     strategy:
@@ -30,13 +32,15 @@ jobs:
           - platform: x64
           - configuration: Release
 
-    runs-on: '${{ matrix.os }}'
+    runs-on: ${{ matrix.os }}
 
-    name: '${{ matrix.toolset }}'
+    name: ${{ matrix.toolset }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Cache Boost
         uses: actions/cache@v6
@@ -49,9 +53,9 @@ jobs:
         if: runner.os == 'Windows'
 
       - name: Set common variables
-        uses: ./.github/actions/common-variables
+        uses: $/.github/actions/common-variables
         with:
-          toolset: '${{ matrix.toolset }}'
+          toolset: ${{ matrix.toolset }}
 
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -59,57 +63,57 @@ jobs:
           python-version: '3.x'
 
       - name: Set up software environment
-        uses: ./.github/actions/software-environment
+        uses: $/.github/actions/software-environment
         with:
-          toolset: '${{ matrix.toolset }}'
-          platform: '${{ matrix.platform }}'
+          toolset: ${{ matrix.toolset }}
+          platform: ${{ matrix.platform }}
 
       - name: Download Boost
-        uses: ./.github/actions/download-boost
+        uses: $/.github/actions/download-boost
         with:
-          boost-version: '${{ matrix.boost-version }}'
+          boost-version: ${{ matrix.boost-version }}
 
       - name: Build Boost
-        uses: ./.github/actions/build-boost
+        uses: $/.github/actions/build-boost
         with:
-          toolset: '${{ matrix.toolset }}'
-          libraries: '${{ matrix.libraries }}'
-          platform: '${{ matrix.platform }}'
-          configuration: '${{ matrix.configuration }}'
+          toolset: ${{ matrix.toolset }}
+          libraries: ${{ matrix.libraries }}
+          platform: ${{ matrix.platform }}
+          configuration: ${{ matrix.configuration }}
         continue-on-error: true
 
       - name: Check that Boost was bootstrapped
-        uses: ./.github/actions/check-boost-bootstrapped
+        uses: $/.github/actions/check-boost-bootstrapped
 
       - name: Check that Boost libraries were built
-        uses: ./.github/actions/check-boost-libraries
+        uses: $/.github/actions/check-boost-libraries
         with:
-          libraries: '${{ matrix.libraries }}'
-          platform: '${{ matrix.platform }}'
-          configuration: '${{ matrix.configuration }}'
+          libraries: ${{ matrix.libraries }}
+          platform: ${{ matrix.platform }}
+          configuration: ${{ matrix.configuration }}
 
       - name: Build examples/boost
         id: build_example
-        uses: ./.github/actions/build-example
+        uses: $/.github/actions/build-example
         with:
           src-dir: test/examples/boost
-          boost-dir: '${{ env.BOOST_DIR }}'
-          toolset: '${{ matrix.toolset }}'
-          platform: '${{ matrix.platform }}'
-          configuration: '${{ matrix.configuration }}'
+          boost-dir: ${{ env.BOOST_DIR }}
+          toolset: ${{ matrix.toolset }}
+          platform: ${{ matrix.platform }}
+          configuration: ${{ matrix.configuration }}
 
       - name: Verify runtime library linkage
-        uses: ./.github/actions/check-runtime-library
+        uses: $/.github/actions/check-runtime-library
         with:
-          path: '${{ steps.build_example.outputs.install-dir }}'
+          path: ${{ steps.build_example.outputs.install-dir }}
 
       - name: Verify architecture
-        uses: ./.github/actions/check-arch
+        uses: $/.github/actions/check-arch
         with:
-          path: '${{ steps.build_example.outputs.install-dir }}'
-          expected: '${{ matrix.platform }}'
+          path: ${{ steps.build_example.outputs.install-dir }}
+          expected: ${{ matrix.platform }}
 
       - name: Run examples/boost
-        uses: ./.github/actions/run-example-boost
+        uses: $/.github/actions/run-example-boost
         with:
-          path: '${{ steps.build_example.outputs.install-dir }}'
+          path: ${{ steps.build_example.outputs.install-dir }}