Merge tag 'v2.4.16' into debian

v2.4.16

5 files changed, 34 insertions, 9 deletions

diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
deleted file mode 100644
index eeec97d..0000000
--- a/.git-blame-ignore-revs
+++ /dev/null
@@ -1 +0,0 @@
-fd32c6ae8ad6c8ac4329d1b6e9796fa843e684a9
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e65fe41..6542be1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,8 +4,19 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
     target-branch: debian
+    cooldown:
+      default-days: 7
+  - package-ecosystem: gitsubmodule
+    directories:
+      - '**/*'
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4fc1792..739b82e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,20 +4,28 @@ on:
   push:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     name: Linting
     continue-on-error: "${{ github.ref != 'refs/heads/master' }}"
+    permissions:
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
           python-version: '3.x'
       - name: Run black
         uses: psf/black@stable
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@v0.7.1
 
   test:
     strategy:
@@ -31,20 +39,21 @@ jobs:
           - '3.14'
           - '3.x'
     runs-on: ubuntu-latest
-    name: 'Python ${{ matrix.python-version }}'
+    name: Python ${{ matrix.python-version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           submodules: recursive
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
-          python-version: '${{ matrix.python-version }}'
+          python-version: ${{ matrix.python-version }}
       - name: Run tests as root
-        run: sudo ./test/runner/main.sh
+        run: sudo ./test/runner/harness
       - name: Run tests
-        run: ./test/runner/main.sh
+        run: ./test/runner/harness
 
   aur:
     name: Publish to AUR
@@ -57,9 +66,8 @@ jobs:
       && !startsWith(github.ref, 'refs/tags/debian/')
     container:
       image: archlinux:base-devel
-      env:
-        SSH_KEY: |
-          ${{ secrets.SSH_KEY }}
+    permissions:
+      contents: write
     steps:
       # This step must be done before actions/checkout. From the latter's
       # output:
@@ -72,9 +80,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
         with:
+          persist-credentials: true
           ref: aur
           submodules: recursive
-          token: '${{ secrets.GH_TOKEN }}'
       - name: Run maintenance
+        env:
+          SSH_KEY: ${{ secrets.SSH_KEY }}
         run: |
           make -C "$GITHUB_WORKSPACE" ci
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..2ef0d8f
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        '*': ref-pin
diff --git a/test/runner b/test/runner
-Subproject a8e017fedcae615576f61d28ac273449053f6f8
+Subproject 5dd19d7079304f6a79e8ddfcc942360f1d1dcf9