From 71b60e1e2c8329bd70161979467ecfd917f4f464 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Sat, 17 Oct 2026 09:10:13 +0500 Subject: fix zizmor warnings --- .github/actions/build-threads/action.yml | 12 ++++---- .github/actions/check-cc/action.yml | 6 ++-- .github/actions/check-lld/action.yml | 6 ++-- .github/dependabot.yml | 2 ++ .github/workflows/test.yml | 50 +++++++++++++++++++------------- action.yml | 37 +++++++++++------------ 6 files changed, 65 insertions(+), 48 deletions(-) diff --git a/.github/actions/build-threads/action.yml b/.github/actions/build-threads/action.yml index 8c754b0..86515f7 100644 --- a/.github/actions/build-threads/action.yml +++ b/.github/actions/build-threads/action.yml @@ -11,12 +11,12 @@ inputs: runs: using: composite steps: - - run: | - $version = '${{ inputs.version }}' - $version = if ($version) { "-$version" } else { $version } - + - env: + ARG_BINARY: ${{ inputs.binary }} + ARG_PLATFORM: ${{ inputs.platform }} + run: | $flags = @() - if ('${{ matrix.platform }}' -eq 'x86') { + if ($env:ARG_PLATFORM -eq 'x86') { $flags += '-m32' } $flags += '-std=c++14','-o','test/threads.exe','test/threads.cpp' @@ -24,5 +24,5 @@ runs: $flags += '-lpthread' } - & '${{ inputs.binary }}' $flags + & $env:ARG_BINARY $flags shell: pwsh diff --git a/.github/actions/check-cc/action.yml b/.github/actions/check-cc/action.yml index 4dbeb0a..646babc 100644 --- a/.github/actions/check-cc/action.yml +++ b/.github/actions/check-cc/action.yml @@ -7,7 +7,9 @@ inputs: runs: using: composite steps: - - run: | + - env: + ARG_VERSION: ${{ inputs.version }} + run: | function Check-Exe { param( [Parameter(Mandatory=$true)] @@ -20,7 +22,7 @@ runs: $($output | Select-String -Pattern "clang version" -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output") - $version = '${{ inputs.version }}' + $version = $env:ARG_VERSION if ($version) { $($output | Select-String -Pattern "$version." -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output") } diff --git a/.github/actions/check-lld/action.yml b/.github/actions/check-lld/action.yml index 5bb25b6..1eea794 100644 --- a/.github/actions/check-lld/action.yml +++ b/.github/actions/check-lld/action.yml @@ -7,7 +7,9 @@ inputs: runs: using: composite steps: - - run: | + - env: + ARG_VERSION: ${{ inputs.version }} + run: | function Check-Exe { param( [Parameter(Mandatory=$true)] @@ -23,7 +25,7 @@ runs: $($output | Select-String -Pattern $HelpString -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output") } - $version = '${{ inputs.version }}' + $version = $env:ARG_VERSION $driver_exe = 'lld' # Although the output of `lld --version` claims that it's ld-link on diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ca79ca5..9cbb9b7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,5 @@ updates: directory: / schedule: interval: weekly + cooldown: + default-days: 7 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 895b14a..81ddfa2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -9,33 +9,38 @@ on: - cron: '30 00 * * 5' workflow_dispatch: +permissions: {} + jobs: test: strategy: matrix: platform: [x86, x64] os: [ubuntu-22.04, ubuntu-24.04, ubuntu-26.04, windows-2022, windows-2025] - runs-on: '${{ matrix.os }}' - name: 'Test: ${{ matrix.os }} / ${{ matrix.platform }}' + runs-on: ${{ matrix.os }} + name: | + Test: ${{ matrix.os }} / ${{ matrix.platform }} steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Clean up PATH uses: egor-tensin/cleanup-path@v5 if: runner.os == 'Windows' - name: Set up Clang - uses: ./ + uses: $/ with: - platform: '${{ matrix.platform }}' + platform: ${{ matrix.platform }} cc: 1 - name: Build threads.exe - uses: ./.github/actions/build-threads + uses: $/.github/actions/build-threads - name: Run threads.exe - uses: ./.github/actions/run-threads + uses: $/.github/actions/run-threads - name: Check symlinks - uses: ./.github/actions/check-cc + uses: $/.github/actions/check-cc - name: Check lld - uses: ./.github/actions/check-lld + uses: $/.github/actions/check-lld test_versions: needs: test @@ -55,32 +60,35 @@ jobs: - {os: ubuntu-26.04, version: 14} - {os: ubuntu-26.04, version: 15} - {os: ubuntu-26.04, version: 16} - runs-on: '${{ matrix.os }}' - name: 'Version: ${{ matrix.os }} / ${{ matrix.version }}' + runs-on: ${{ matrix.os }} + name: | + Version: ${{ matrix.os }} / ${{ matrix.version }} steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - id: setup name: Set up Clang - uses: ./ + uses: $/ with: - version: '${{ matrix.version }}' - platform: '${{ matrix.platform }}' + version: ${{ matrix.version }} + platform: ${{ matrix.platform }} cc: 1 - name: Build threads.exe - uses: ./.github/actions/build-threads + uses: $/.github/actions/build-threads with: - binary: '${{ steps.setup.outputs.clangxx }}' + binary: ${{ steps.setup.outputs.clangxx }} - name: Run threads.exe - uses: ./.github/actions/run-threads + uses: $/.github/actions/run-threads - name: Check symlinks - uses: ./.github/actions/check-cc + uses: $/.github/actions/check-cc with: - version: '${{ matrix.version }}' + version: ${{ matrix.version }} - name: Check lld - uses: ./.github/actions/check-lld + uses: $/.github/actions/check-lld with: - version: '${{ matrix.version }}' + version: ${{ matrix.version }} release: if: github.ref_type == 'tag' @@ -94,5 +102,7 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Release uses: softprops/action-gh-release@v3 diff --git a/action.yml b/action.yml index cd6c626..e45b0f1 100644 --- a/action.yml +++ b/action.yml @@ -27,15 +27,16 @@ runs: using: composite steps: - id: install + env: + ARG_VERSION: ${{ inputs.version }} + ARG_PLATFORM: ${{ inputs.platform }} run: | - New-Variable os -Value '${{ runner.os }}' -Option Constant + $linux_host = '${{ runner.os }}' -eq 'Linux' + $windows_host = '${{ runner.os }}' -eq 'Windows' - New-Variable linux_host -Value ($os -eq 'Linux') -Option Constant - New-Variable windows_host -Value ($os -eq 'Windows') -Option Constant - - New-Variable version -Value ('${{ inputs.version }}') -Option Constant - New-Variable latest -Value ($version -eq 'latest') -Option Constant - New-Variable x64 -Value ('${{ inputs.platform }}' -eq 'x64') -Option Constant + $version = $env:ARG_VERSION + $latest = $version -eq 'latest' + $x64 = $env:ARG_PLATFORM -eq 'x64' function Locate-Choco { $path = Get-Command 'choco' -ErrorAction SilentlyContinue @@ -158,9 +159,7 @@ runs: Install-Package $packages } elseif ($windows_host) { Install-Package llvm - - $bin_dir = Join-Path $env:ProgramFiles LLVM bin - echo $bin_dir >> $env:GITHUB_PATH + echo 'C:\Program Files\LLVM\bin' >> $env:GITHUB_PATH } else { throw "Sorry, installing Clang is unsupported on $os" } @@ -170,16 +169,18 @@ runs: echo "lld=$lld" >> $env:GITHUB_OUTPUT shell: pwsh - - run: | - New-Variable os -Value '${{ runner.os }}' -Option Constant - - New-Variable linux_host -Value ($os -eq 'Linux') -Option Constant - New-Variable windows_host -Value ($os -eq 'Windows') -Option Constant + - env: + ARG_CC: ${{ inputs.cc }} + CLANG: ${{ steps.install.outputs.clang }} + CLANGXX: ${{ steps.install.outputs.clangxx }} + run: | + $linux_host = '${{ runner.os }}' -eq 'Linux' + $windows_host = '${{ runner.os }}' -eq 'Windows' - New-Variable cc -Value ('${{ inputs.cc }}' -eq '1') -Option Constant + $cc = $env:ARG_CC -eq '1' - New-Variable clang -Value '${{ steps.install.outputs.clang }}' -Option Constant - New-Variable clangxx -Value '${{ steps.install.outputs.clangxx }}' -Option Constant + $clang = $env:CLANG + $clangxx = $env:CLANGXX function Link-Exe { param( -- cgit v1.3