From 00e9f83b07d700342e7143bf0cc6245d7323501c Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Sat, 17 Oct 2026 14:06:33 +0500 Subject: fix some zizmor warnings --- .github/workflows/aur.yml | 8 ++-- .github/workflows/basic.yml | 7 +++- .github/workflows/boost_download.yml | 10 +++-- .github/workflows/boost_toolsets.yml | 74 ++++++++++++++++++---------------- .github/workflows/ci.yml | 19 +++++---- .github/workflows/example_toolsets.yml | 54 +++++++++++++------------ .github/workflows/lint.yml | 4 ++ .github/workflows/msvc_versions.yml | 66 ++++++++++++++++-------------- 8 files changed, 136 insertions(+), 106 deletions(-) (limited to '.github/workflows') diff --git a/.github/workflows/aur.yml b/.github/workflows/aur.yml index 83caa62..efb5481 100644 --- a/.github/workflows/aur.yml +++ b/.github/workflows/aur.yml @@ -4,6 +4,8 @@ on: workflow_call: workflow_dispatch: +permissions: {} + jobs: publish: name: Publish to AUR @@ -11,8 +13,7 @@ jobs: container: image: archlinux:base-devel env: - SSH_KEY: | - ${{ secrets.SSH_KEY }} + SSH_KEY: ${{ secrets.SSH_KEY }} steps: # This step must be done before actions/checkout. From the latter's # output: @@ -25,8 +26,9 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false ref: aur - token: '${{ secrets.GH_TOKEN }}' + token: ${{ secrets.GH_TOKEN }} - name: Run maintenance run: | make -C "$GITHUB_WORKSPACE" ci diff --git a/.github/workflows/basic.yml b/.github/workflows/basic.yml index 8d2bc1e..6c3be3e 100644 --- a/.github/workflows/basic.yml +++ b/.github/workflows/basic.yml @@ -4,6 +4,8 @@ on: workflow_call: workflow_dispatch: +permissions: {} + jobs: # Check that the most basic use-case works on different OSs. os: @@ -19,7 +21,7 @@ jobs: - macos-26 include: - boost-version: 1.91.0 - runs-on: '${{ matrix.os }}' + runs-on: ${{ matrix.os }} name: 'Image: ${{ matrix.os }}' defaults: run: @@ -27,6 +29,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@v7 with: @@ -68,6 +72,7 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 0 + persist-credentials: false - name: Set up Python uses: actions/setup-python@v7 with: diff --git a/.github/workflows/boost_download.yml b/.github/workflows/boost_download.yml index ea928da..dfb397b 100644 --- a/.github/workflows/boost_download.yml +++ b/.github/workflows/boost_download.yml @@ -4,6 +4,8 @@ on: workflow_call: workflow_dispatch: +permissions: {} + jobs: build: strategy: @@ -18,14 +20,16 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@v7 with: python-version: '3.x' - name: Download Boost - uses: ./.github/actions/download-boost + uses: $/.github/actions/download-boost with: - boost-version: '${{ matrix.boost-version }}' + boost-version: ${{ matrix.boost-version }} no-retry: 1 - name: Check that Boost was downloaded - uses: ./.github/actions/check-boost-download + uses: $/.github/actions/check-boost-download diff --git a/.github/workflows/boost_toolsets.yml b/.github/workflows/boost_toolsets.yml index 8d2b878..924e3d7 100644 --- a/.github/workflows/boost_toolsets.yml +++ b/.github/workflows/boost_toolsets.yml @@ -4,6 +4,8 @@ on: workflow_call: workflow_dispatch: +permissions: {} + jobs: build: strategy: @@ -55,9 +57,9 @@ jobs: - {os: windows-2025, boost-version: 1.72.0} - {os: windows-2025, boost-version: 1.82.0} - runs-on: '${{ matrix.os }}' + runs-on: ${{ matrix.os }} - name: '${{ matrix.boost-version }} / ${{ matrix.toolset }} / ${{ matrix.name }}' + name: ${{ matrix.boost-version }} / ${{ matrix.toolset }} / ${{ matrix.name }} # 1) VS 2022 isn't supported by older Boost versions. It just doesn't # work, the errors are numerous. @@ -74,6 +76,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Cache Boost uses: actions/cache@v6 @@ -86,9 +90,9 @@ jobs: if: runner.os == 'Windows' - name: Set common variables - uses: ./.github/actions/common-variables + uses: $/.github/actions/common-variables with: - toolset: '${{ matrix.toolset }}' + toolset: ${{ matrix.toolset }} - name: Set up Python uses: actions/setup-python@v7 @@ -98,80 +102,80 @@ jobs: - name: Install GCC uses: egor-tensin/setup-gcc@v2 with: - platform: '${{ matrix.platform }}' + platform: ${{ matrix.platform }} if: env.CI_HOST_LINUX && (matrix.toolset == 'auto' || matrix.toolset == 'gcc') - name: Install Clang uses: egor-tensin/setup-clang@v2 with: - platform: '${{ matrix.platform }}' + platform: ${{ matrix.platform }} if: matrix.toolset == 'clang' || matrix.toolset == 'clang-cl' - name: Install MinGW uses: egor-tensin/setup-mingw@v3 with: - platform: '${{ matrix.platform }}' + platform: ${{ matrix.platform }} # toolset == 'clang' needs some kind of make, e.g. mingw32-make: if: env.CI_MINGW || (matrix.toolset == 'clang' && env.CI_HOST_WINDOWS) - name: Set up software environment - uses: ./.github/actions/software-environment + uses: $/.github/actions/software-environment with: - toolset: '${{ matrix.toolset }}' - platform: '${{ matrix.platform }}' + toolset: ${{ matrix.toolset }} + platform: ${{ matrix.platform }} - name: Set up Visual Studio uses: egor-tensin/vs-shell@v2 with: - arch: '${{ matrix.platform }}' + arch: ${{ matrix.platform }} if: matrix.toolset == 'clang-cl' && env.CI_HOST_WINDOWS - name: Download Boost - uses: ./.github/actions/download-boost + uses: $/.github/actions/download-boost with: - boost-version: '${{ matrix.boost-version }}' + boost-version: ${{ matrix.boost-version }} - name: Build Boost - uses: ./.github/actions/build-boost + uses: $/.github/actions/build-boost with: - toolset: '${{ matrix.toolset }}' - libraries: '${{ matrix.libraries }}' - platform: '${{ matrix.platform }}' - configuration: '${{ matrix.configuration }}' + toolset: ${{ matrix.toolset }} + libraries: ${{ matrix.libraries }} + platform: ${{ matrix.platform }} + configuration: ${{ matrix.configuration }} continue-on-error: true - name: Check that Boost was bootstrapped - uses: ./.github/actions/check-boost-bootstrapped + uses: $/.github/actions/check-boost-bootstrapped - name: Check that Boost libraries were built - uses: ./.github/actions/check-boost-libraries + uses: $/.github/actions/check-boost-libraries with: - libraries: '${{ matrix.libraries }}' - platform: '${{ matrix.platform }}' - configuration: '${{ matrix.configuration }}' + libraries: ${{ matrix.libraries }} + platform: ${{ matrix.platform }} + configuration: ${{ matrix.configuration }} - name: Build examples/boost id: build_example - uses: ./.github/actions/build-example + uses: $/.github/actions/build-example with: src-dir: test/examples/boost - boost-dir: '${{ env.BOOST_DIR }}' - toolset: '${{ matrix.toolset }}' - platform: '${{ matrix.platform }}' - configuration: '${{ matrix.configuration }}' + boost-dir: ${{ env.BOOST_DIR }} + toolset: ${{ matrix.toolset }} + platform: ${{ matrix.platform }} + configuration: ${{ matrix.configuration }} - name: Verify runtime library linkage - uses: ./.github/actions/check-runtime-library + uses: $/.github/actions/check-runtime-library with: - path: '${{ steps.build_example.outputs.install-dir }}' + path: ${{ steps.build_example.outputs.install-dir }} - name: Verify architecture - uses: ./.github/actions/check-arch + uses: $/.github/actions/check-arch with: - path: '${{ steps.build_example.outputs.install-dir }}' - expected: '${{ matrix.platform }}' + path: ${{ steps.build_example.outputs.install-dir }} + expected: ${{ matrix.platform }} - name: Run examples/boost - uses: ./.github/actions/run-example-boost + uses: $/.github/actions/run-example-boost with: - path: '${{ steps.build_example.outputs.install-dir }}' + path: ${{ steps.build_example.outputs.install-dir }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ceb15d1..35f7453 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,30 +10,32 @@ on: - cron: '30 01 * * 5' workflow_dispatch: +permissions: {} + jobs: lint: name: Linting - uses: ./.github/workflows/lint.yml + uses: $/.github/workflows/lint.yml basic: name: Basic usage - uses: ./.github/workflows/basic.yml + uses: $/.github/workflows/basic.yml boost_download: name: Boost (download) - uses: ./.github/workflows/boost_download.yml + uses: $/.github/workflows/boost_download.yml boost_toolsets: name: Boost (toolsets) - uses: ./.github/workflows/boost_toolsets.yml + uses: $/.github/workflows/boost_toolsets.yml example_toolsets: name: Examples (toolsets) - uses: ./.github/workflows/example_toolsets.yml + uses: $/.github/workflows/example_toolsets.yml msvc_versions: name: Visual Studio versions - uses: ./.github/workflows/msvc_versions.yml + uses: $/.github/workflows/msvc_versions.yml # Build a Python package and upload to PyPI. publish: @@ -51,6 +53,7 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 0 + persist-credentials: false - name: Set up Python uses: actions/setup-python@v7 with: @@ -72,12 +75,12 @@ jobs: uses: pypa/gh-action-pypi-publish@release/v1 with: user: __token__ - password: '${{ secrets.PYPI_API_TOKEN }}' + password: ${{ secrets.PYPI_API_TOKEN }} aur: name: Publish to AUR needs: - publish if: startsWith(github.ref, 'refs/tags/') - uses: ./.github/workflows/aur.yml + uses: $/.github/workflows/aur.yml secrets: inherit diff --git a/.github/workflows/example_toolsets.yml b/.github/workflows/example_toolsets.yml index f2b083c..ad294d6 100644 --- a/.github/workflows/example_toolsets.yml +++ b/.github/workflows/example_toolsets.yml @@ -4,6 +4,8 @@ on: workflow_call: workflow_dispatch: +permissions: {} + jobs: build: strategy: @@ -64,22 +66,24 @@ jobs: - {os: ubuntu-latest, toolset: msvc} - {os: ubuntu-latest, toolset: clang-cl} - runs-on: '${{ matrix.os }}' + runs-on: ${{ matrix.os }} - name: '${{ matrix.toolset }} / ${{ matrix.name }}' + name: ${{ matrix.toolset }} / ${{ matrix.name }} steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Clean up PATH uses: egor-tensin/cleanup-path@v5 if: runner.os == 'Windows' - name: Set common variables - uses: ./.github/actions/common-variables + uses: $/.github/actions/common-variables with: - toolset: '${{ matrix.toolset }}' + toolset: ${{ matrix.toolset }} - name: Set up Python uses: actions/setup-python@v7 @@ -89,62 +93,62 @@ jobs: - name: Install GCC uses: egor-tensin/setup-gcc@v2 with: - platform: '${{ matrix.platform }}' + platform: ${{ matrix.platform }} if: env.CI_HOST_LINUX && (matrix.toolset == 'auto' || matrix.toolset == 'gcc') - name: Install Clang uses: egor-tensin/setup-clang@v2 with: - platform: '${{ matrix.platform }}' + platform: ${{ matrix.platform }} if: matrix.toolset == 'clang' || matrix.toolset == 'clang-cl' - name: Install MinGW uses: egor-tensin/setup-mingw@v3 with: - platform: '${{ matrix.platform }}' + platform: ${{ matrix.platform }} # toolset == 'clang' needs some kind of make, e.g. mingw32-make: if: env.CI_MINGW || (matrix.toolset == 'clang' && env.CI_HOST_WINDOWS) - name: Set up software environment - uses: ./.github/actions/software-environment + uses: $/.github/actions/software-environment with: - toolset: '${{ matrix.toolset }}' - platform: '${{ matrix.platform }}' + toolset: ${{ matrix.toolset }} + platform: ${{ matrix.platform }} - name: Set up Visual Studio uses: egor-tensin/vs-shell@v2 with: - arch: '${{ matrix.platform }}' + arch: ${{ matrix.platform }} if: matrix.toolset == 'clang-cl' && env.CI_HOST_WINDOWS - name: Build example project id: build - uses: ./.github/actions/build-example + uses: $/.github/actions/build-example with: src-dir: 'test/examples/${{ matrix.example }}' - toolset: '${{ matrix.toolset }}' - platform: '${{ matrix.platform }}' - configuration: '${{ matrix.configuration }}' + toolset: ${{ matrix.toolset }} + platform: ${{ matrix.platform }} + configuration: ${{ matrix.configuration }} - name: Verify runtime library linkage - uses: ./.github/actions/check-runtime-library + uses: $/.github/actions/check-runtime-library with: - path: '${{ steps.build.outputs.install-dir }}' + path: ${{ steps.build.outputs.install-dir }} - name: Verify architecture - uses: ./.github/actions/check-arch + uses: $/.github/actions/check-arch with: - path: '${{ steps.build.outputs.install-dir }}' - expected: '${{ matrix.platform }}' + path: ${{ steps.build.outputs.install-dir }} + expected: ${{ matrix.platform }} - name: Run example project - uses: ./.github/actions/run-example + uses: $/.github/actions/run-example with: - path: '${{ steps.build.outputs.install-dir }}' + path: ${{ steps.build.outputs.install-dir }} #- name: Check symbols - # uses: ./.github/actions/check-symbols + # uses: $/.github/actions/check-symbols # with: - # path: '${{ steps.build.outputs.install-dir }}' - # expected: '${{ toJson(matrix.symbols) }}' + # path: ${{ steps.build.outputs.install-dir }} + # expected: ${{ toJson(matrix.symbols) }} # if: env.CI_TARGET_ELF diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 5566327..ad838b6 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -4,6 +4,8 @@ on: workflow_call: workflow_dispatch: +permissions: {} + jobs: # Check that project.format works (and the C/C++ files are formatted). lint: @@ -13,6 +15,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@v7 with: diff --git a/.github/workflows/msvc_versions.yml b/.github/workflows/msvc_versions.yml index d8060e7..04c7307 100644 --- a/.github/workflows/msvc_versions.yml +++ b/.github/workflows/msvc_versions.yml @@ -4,6 +4,8 @@ on: workflow_call: workflow_dispatch: +permissions: {} + jobs: build: strategy: @@ -30,13 +32,15 @@ jobs: - platform: x64 - configuration: Release - runs-on: '${{ matrix.os }}' + runs-on: ${{ matrix.os }} - name: '${{ matrix.toolset }}' + name: ${{ matrix.toolset }} steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Cache Boost uses: actions/cache@v6 @@ -49,9 +53,9 @@ jobs: if: runner.os == 'Windows' - name: Set common variables - uses: ./.github/actions/common-variables + uses: $/.github/actions/common-variables with: - toolset: '${{ matrix.toolset }}' + toolset: ${{ matrix.toolset }} - name: Set up Python uses: actions/setup-python@v7 @@ -59,57 +63,57 @@ jobs: python-version: '3.x' - name: Set up software environment - uses: ./.github/actions/software-environment + uses: $/.github/actions/software-environment with: - toolset: '${{ matrix.toolset }}' - platform: '${{ matrix.platform }}' + toolset: ${{ matrix.toolset }} + platform: ${{ matrix.platform }} - name: Download Boost - uses: ./.github/actions/download-boost + uses: $/.github/actions/download-boost with: - boost-version: '${{ matrix.boost-version }}' + boost-version: ${{ matrix.boost-version }} - name: Build Boost - uses: ./.github/actions/build-boost + uses: $/.github/actions/build-boost with: - toolset: '${{ matrix.toolset }}' - libraries: '${{ matrix.libraries }}' - platform: '${{ matrix.platform }}' - configuration: '${{ matrix.configuration }}' + toolset: ${{ matrix.toolset }} + libraries: ${{ matrix.libraries }} + platform: ${{ matrix.platform }} + configuration: ${{ matrix.configuration }} continue-on-error: true - name: Check that Boost was bootstrapped - uses: ./.github/actions/check-boost-bootstrapped + uses: $/.github/actions/check-boost-bootstrapped - name: Check that Boost libraries were built - uses: ./.github/actions/check-boost-libraries + uses: $/.github/actions/check-boost-libraries with: - libraries: '${{ matrix.libraries }}' - platform: '${{ matrix.platform }}' - configuration: '${{ matrix.configuration }}' + libraries: ${{ matrix.libraries }} + platform: ${{ matrix.platform }} + configuration: ${{ matrix.configuration }} - name: Build examples/boost id: build_example - uses: ./.github/actions/build-example + uses: $/.github/actions/build-example with: src-dir: test/examples/boost - boost-dir: '${{ env.BOOST_DIR }}' - toolset: '${{ matrix.toolset }}' - platform: '${{ matrix.platform }}' - configuration: '${{ matrix.configuration }}' + boost-dir: ${{ env.BOOST_DIR }} + toolset: ${{ matrix.toolset }} + platform: ${{ matrix.platform }} + configuration: ${{ matrix.configuration }} - name: Verify runtime library linkage - uses: ./.github/actions/check-runtime-library + uses: $/.github/actions/check-runtime-library with: - path: '${{ steps.build_example.outputs.install-dir }}' + path: ${{ steps.build_example.outputs.install-dir }} - name: Verify architecture - uses: ./.github/actions/check-arch + uses: $/.github/actions/check-arch with: - path: '${{ steps.build_example.outputs.install-dir }}' - expected: '${{ matrix.platform }}' + path: ${{ steps.build_example.outputs.install-dir }} + expected: ${{ matrix.platform }} - name: Run examples/boost - uses: ./.github/actions/run-example-boost + uses: $/.github/actions/run-example-boost with: - path: '${{ steps.build_example.outputs.install-dir }}' + path: ${{ steps.build_example.outputs.install-dir }} -- cgit v1.3