fix zizmor warnings

4 files changed, 58 insertions, 35 deletions

diff --git a/.github/actions/check-cc/action.yml b/.github/actions/check-cc/action.yml
index 9f29631..c388819 100644
--- a/.github/actions/check-cc/action.yml
+++ b/.github/actions/check-cc/action.yml
@@ -7,7 +7,9 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
+    - env:
+        ARG_VERSION: ${{ inputs.version }}
+      run: |
         function Check-Exe {
             param(
                 [Parameter(Mandatory=$true)]
@@ -19,9 +21,10 @@ runs:
             echo $output
 
             # Is this really the most stable piece of `gcc --version` output?
-            $($output | Select-String -Pattern "This is free software; see the source for copying conditions." -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output")
+            $pattern = "This is free software; see the source for copying conditions."
+            $($output | Select-String -Pattern $pattern -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output")
 
-            $version = '${{ inputs.version }}'
+            $version = $env:ARG_VERSION
             if ($version) {
                 $($output | Select-String -Pattern $version -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output")
             }
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ca79ca5..9cbb9b7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,5 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e445f93..9fe846d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,6 +9,8 @@ on:
     - cron: '30 00 * * 5'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   test:
     strategy:
@@ -17,31 +19,36 @@ jobs:
       matrix:
         platform: [x86, x64]
         os: [ubuntu-22.04, ubuntu-24.04, ubuntu-latest, windows-2022, windows-2025, windows-latest]
-    runs-on: '${{ matrix.os }}'
-    name: 'Test: ${{ matrix.os }} / ${{ matrix.platform }}'
+    runs-on: ${{ matrix.os }}
+    name: |
+      Test: ${{ matrix.os }} / ${{ matrix.platform }}
     defaults:
       run:
         shell: pwsh
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Clean up PATH
         uses: egor-tensin/cleanup-path@v5
         if: runner.os == 'Windows'
       - name: Set up MinGW
         id: setup
-        uses: ./
+        uses: $/
         with:
-          platform: '${{ matrix.platform }}'
+          platform: ${{ matrix.platform }}
           cc: 1
       - name: Build threads.exe
+        env:
+          GXX: ${{ steps.setup.outputs.gxx }}
         run: |
-          & '${{ steps.setup.outputs.gxx }}' -std=c++14 -o (Join-Path . test threads) (Join-Path . test threads.cpp)
+          & $env:GXX -std=c++14 -o (Join-Path . test threads) (Join-Path . test threads.cpp)
       - name: Run threads.exe
-        uses: ./.github/actions/run-threads
+        uses: $/.github/actions/run-threads
         if: runner.os == 'Windows'
       - name: Check cc/c++
-        uses: ./.github/actions/check-cc
+        uses: $/.github/actions/check-cc
 
   test_windows_versions:
     strategy:
@@ -51,29 +58,34 @@ jobs:
           - 12.2.0
           - 15.2.0
     runs-on: windows-latest
-    name: 'Version: ${{ matrix.version }}'
+    name: |
+      Version: ${{ matrix.version }}
     defaults:
       run:
         shell: pwsh
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Clean up PATH
         uses: egor-tensin/cleanup-path@v5
       - name: Set up MinGW
         id: setup
-        uses: ./
+        uses: $/
         with:
-          version: '${{ matrix.version }}'
+          version: ${{ matrix.version }}
       - name: Verify the version
-        uses: ./.github/actions/check-cc
+        uses: $/.github/actions/check-cc
         with:
-          version: '${{ matrix.version }}'
+          version: ${{ matrix.version }}
       - name: Build threads.exe
+        env:
+          GXX: ${{ steps.setup.outputs.gxx }}
         run: |
-          & '${{ steps.setup.outputs.gxx }}' -std=c++14 -o (Join-Path . test threads) (Join-Path . test threads.cpp)
+          & $env:GXX -std=c++14 -o (Join-Path . test threads) (Join-Path . test threads.cpp)
       - name: Run threads.exe
-        uses: ./.github/actions/run-threads
+        uses: $/.github/actions/run-threads
 
   release:
     if: github.ref_type == 'tag'
@@ -87,5 +99,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Release
         uses: softprops/action-gh-release@v3
diff --git a/action.yml b/action.yml
index cb41907..0d3c882 100644
--- a/action.yml
+++ b/action.yml
@@ -18,30 +18,32 @@ inputs:
 outputs:
   prefix:
     description: Cross-compilation toolchain prefix
-    value: '${{ steps.setup.outputs.prefix }}'
+    value: ${{ steps.setup.outputs.prefix }}
   gcc:
     description: gcc binary name
-    value: '${{ steps.setup.outputs.gcc }}'
+    value: ${{ steps.setup.outputs.gcc }}
   gxx:
     description: g++ binary name
-    value: '${{ steps.setup.outputs.gxx }}'
+    value: ${{ steps.setup.outputs.gxx }}
   windres:
     description: windres binary name
-    value: '${{ steps.setup.outputs.windres }}'
+    value: ${{ steps.setup.outputs.windres }}
 
 runs:
   using: composite
   steps:
     - id: setup
+      env:
+        ARG_VERSION: ${{ inputs.version }}
+        ARG_PLATFORM: ${{ inputs.platform }}
       run: |
-        New-Variable os -Value '${{ runner.os }}' -Option Constant
-        New-Variable mingw_version -Value '${{ inputs.version }}' -Option Constant
-        New-Variable mingw_version_supplied -Value ('${{ inputs.version }}' -ne '') -Option Constant
+        $linux_host = '${{ runner.os }}' -eq 'Linux'
+        $windows_host = '${{ runner.os }}' -eq 'Windows'
 
-        New-Variable linux_host -Value ($os -eq 'Linux') -Option Constant
-        New-Variable windows_host -Value ($os -eq 'Windows') -Option Constant
+        $mingw_version = $env:ARG_VERSION
+        $mingw_version_supplied = $mingw_version -ne ''
 
-        New-Variable x64 -Value ('${{ inputs.platform }}' -eq 'x64') -Option Constant
+        $x64 = $env:ARG_PLATFORM -eq 'x64'
 
         $prefix32 = 'i686-w64-mingw32'
         $prefix64 = 'x86_64-w64-mingw32'
@@ -159,13 +161,15 @@ runs:
         echo "windres=$windres" >> $env:GITHUB_OUTPUT
       shell: pwsh
 
-    - run: |
-        New-Variable os -Value '${{ runner.os }}' -Option Constant
-
-        New-Variable linux_host -Value ($os -eq 'Linux') -Option Constant
-        New-Variable windows_host -Value ($os -eq 'Windows') -Option Constant
+    - env:
+        ARG_CC: ${{ inputs.cc }}
+        GCC: ${{ steps.setup.outputs.gcc }}
+        GXX: ${{ steps.setup.outputs.gxx }}
+      run: |
+        $linux_host = '${{ runner.os }}' -eq 'Linux'
+        $windows_host = '${{ runner.os }}' -eq 'Windows'
 
-        New-Variable cc -Value ('${{ inputs.cc }}' -eq '1') -Option Constant
+        $cc = $env:ARG_CC -eq '1'
 
         function Link-Exe {
             param(
@@ -189,8 +193,8 @@ runs:
         }
 
         if ($cc) {
-            Link-Exe '${{ steps.setup.outputs.gcc }}' cc
-            Link-Exe '${{ steps.setup.outputs.gxx }}' c++
+            Link-Exe $env:GCC cc
+            Link-Exe $env:GXX c++
         }
       shell: pwsh