Merge tag 'v2.1.17' into debian

v2.1.17

5 files changed, 48 insertions, 12 deletions

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e65fe41..6542be1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,8 +4,19 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
     target-branch: debian
+    cooldown:
+      default-days: 7
+  - package-ecosystem: gitsubmodule
+    directories:
+      - '**/*'
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df69ff6..c1c6e02 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,19 +4,36 @@ on:
   push:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
+  lint:
+    name: Linting
+    runs-on: ubuntu-slim
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@v0.7.1
+
   test_local:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest]
-    runs-on: '${{ matrix.os }}'
-    name: 'Test / ${{ matrix.os }}'
+        os:
+          - ubuntu-latest
+          - macos-latest
+    runs-on: ${{ matrix.os }}
+    name: Test / ${{ matrix.os }}
     steps:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           submodules: recursive
-
       - name: Install dependencies
         run: |
           brew install bash coreutils findutils
@@ -25,7 +42,6 @@ jobs:
         if: runner.os == 'macOS'
         # Is it even macOS anymore? It is for me. I really am too lazy to deal
         # with ancient utilities that come with the actual macOS.
-
       - name: Test
         run: make test
 
@@ -41,18 +57,21 @@ jobs:
           - noble
           - resolute
     runs-on: ubuntu-latest
-    name: 'Test / Docker / ${{ matrix.distro }}'
+    name: Test / Docker / ${{ matrix.distro }}
     steps:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           submodules: recursive
       - name: Test
-        run: make 'test/docker/${{ matrix.distro }}'
+        run: |
+          make 'test/docker/${{ matrix.distro }}'
 
   aur:
     name: Publish to AUR
     needs:
+      - lint
       - test_local
       - test_docker
     runs-on: ubuntu-latest
@@ -61,9 +80,8 @@ jobs:
       && !startsWith(github.ref, 'refs/tags/debian/')
     container:
       image: archlinux:base-devel
-      env:
-        SSH_KEY: |
-          ${{ secrets.SSH_KEY }}
+    permissions:
+      contents: write
     steps:
       # This step must be done before actions/checkout. From the latter's
       # output:
@@ -76,9 +94,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: true
           ref: aur
           submodules: recursive
-          token: '${{ secrets.GH_TOKEN }}'
       - name: Run maintenance
+        env:
+          SSH_KEY: ${{ secrets.SSH_KEY }}
         run: |
           make -C "$GITHUB_WORKSPACE" ci
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..2ef0d8f
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        '*': ref-pin
diff --git a/Makefile b/Makefile
index 57f0431..252a237 100644
--- a/Makefile
+++ b/Makefile
@@ -11,7 +11,7 @@ all:
 
 .PHONY: test
 test:
-	./test/runner/main.sh
+	./test/runner/harness
 
 test/docker/%: DO
 	cd test/docker && \
diff --git a/test/runner b/test/runner
-Subproject a8e017fedcae615576f61d28ac273449053f6f8
+Subproject 5dd19d7079304f6a79e8ddfcc942360f1d1dcf9