From cc0329f0f9c3e5202ee04144ac1b0a196d974ade Mon Sep 17 00:00:00 2001
From: Egor Tensin <egor@tensin.name>
Date: Sat, 17 Oct 2026 13:17:38 +0500
Subject: fix zizmor warnings

---
 .github/actions/check-cc/action.yml |  9 +++++---
 .github/dependabot.yml              |  2 ++
 .github/workflows/test.yml          | 42 ++++++++++++++++++++++++-------------
 3 files changed, 36 insertions(+), 17 deletions(-)

(limited to '.github')

diff --git a/.github/actions/check-cc/action.yml b/.github/actions/check-cc/action.yml
index 9f29631..c388819 100644
--- a/.github/actions/check-cc/action.yml
+++ b/.github/actions/check-cc/action.yml
@@ -7,7 +7,9 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: |
+    - env:
+        ARG_VERSION: ${{ inputs.version }}
+      run: |
         function Check-Exe {
             param(
                 [Parameter(Mandatory=$true)]
@@ -19,9 +21,10 @@ runs:
             echo $output
 
             # Is this really the most stable piece of `gcc --version` output?
-            $($output | Select-String -Pattern "This is free software; see the source for copying conditions." -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output")
+            $pattern = "This is free software; see the source for copying conditions."
+            $($output | Select-String -Pattern $pattern -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output")
 
-            $version = '${{ inputs.version }}'
+            $version = $env:ARG_VERSION
             if ($version) {
                 $($output | Select-String -Pattern $version -SimpleMatch -Quiet) -or $(throw "Unexpected `$Exe --version` output")
             }
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ca79ca5..9cbb9b7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,5 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e445f93..9fe846d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,6 +9,8 @@ on:
     - cron: '30 00 * * 5'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   test:
     strategy:
@@ -17,31 +19,36 @@ jobs:
       matrix:
         platform: [x86, x64]
         os: [ubuntu-22.04, ubuntu-24.04, ubuntu-latest, windows-2022, windows-2025, windows-latest]
-    runs-on: '${{ matrix.os }}'
-    name: 'Test: ${{ matrix.os }} / ${{ matrix.platform }}'
+    runs-on: ${{ matrix.os }}
+    name: |
+      Test: ${{ matrix.os }} / ${{ matrix.platform }}
     defaults:
       run:
         shell: pwsh
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Clean up PATH
         uses: egor-tensin/cleanup-path@v5
         if: runner.os == 'Windows'
       - name: Set up MinGW
         id: setup
-        uses: ./
+        uses: $/
         with:
-          platform: '${{ matrix.platform }}'
+          platform: ${{ matrix.platform }}
           cc: 1
       - name: Build threads.exe
+        env:
+          GXX: ${{ steps.setup.outputs.gxx }}
         run: |
-          & '${{ steps.setup.outputs.gxx }}' -std=c++14 -o (Join-Path . test threads) (Join-Path . test threads.cpp)
+          & $env:GXX -std=c++14 -o (Join-Path . test threads) (Join-Path . test threads.cpp)
       - name: Run threads.exe
-        uses: ./.github/actions/run-threads
+        uses: $/.github/actions/run-threads
         if: runner.os == 'Windows'
       - name: Check cc/c++
-        uses: ./.github/actions/check-cc
+        uses: $/.github/actions/check-cc
 
   test_windows_versions:
     strategy:
@@ -51,29 +58,34 @@ jobs:
           - 12.2.0
           - 15.2.0
     runs-on: windows-latest
-    name: 'Version: ${{ matrix.version }}'
+    name: |
+      Version: ${{ matrix.version }}
     defaults:
       run:
         shell: pwsh
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Clean up PATH
         uses: egor-tensin/cleanup-path@v5
       - name: Set up MinGW
         id: setup
-        uses: ./
+        uses: $/
         with:
-          version: '${{ matrix.version }}'
+          version: ${{ matrix.version }}
       - name: Verify the version
-        uses: ./.github/actions/check-cc
+        uses: $/.github/actions/check-cc
         with:
-          version: '${{ matrix.version }}'
+          version: ${{ matrix.version }}
       - name: Build threads.exe
+        env:
+          GXX: ${{ steps.setup.outputs.gxx }}
         run: |
-          & '${{ steps.setup.outputs.gxx }}' -std=c++14 -o (Join-Path . test threads) (Join-Path . test threads.cpp)
+          & $env:GXX -std=c++14 -o (Join-Path . test threads) (Join-Path . test threads.cpp)
       - name: Run threads.exe
-        uses: ./.github/actions/run-threads
+        uses: $/.github/actions/run-threads
 
   release:
     if: github.ref_type == 'tag'
@@ -87,5 +99,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Release
         uses: softprops/action-gh-release@v3
-- 
cgit v1.3