Remove dangerous template expansion: https://docs.zizmor.sh/audits/#template-injection

Delete coverage-report action as it's not being used.

Author: blowdart

.github/workflows/ci-manual-build-test-sign.yml

@@ -23,7 +23,7 @@ env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: false
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
   DOTNET_CLI_TELEMETRY_OPTOUT: true
-  nupkgDirectory: ${{ github.workspace}}/nupkgs
+  NUPKGDIRECTORY: ${{ github.workspace}}/nupkgs
 
 jobs:
   build:
@@ -58,32 +58,32 @@ jobs:
       run: dotnet test --configuration Release --no-restore --no-build --property:PublicRelease=${{ inputs.public_release }}
 
     - name: 'Pack release'
-      run: dotnet pack --configuration Release --no-restore  --no-build --output ${{ env.nupkgDirectory }} --property:PublicRelease=${{ inputs.public_release }}
+      run: dotnet pack --configuration Release --no-restore  --no-build --output ${NUPKGDIRECTORY} --property:PublicRelease=${{ inputs.public_release }}
 
     - name: 'List artifact directory'
       shell: pwsh
       run: >
-        Get-ChildItem -Path ${{ env.nupkgDirectory }} -Recurse -Force
+        Get-ChildItem -Path ${env:NUPKGDIRECTORY} -Recurse -Force
 
     - name: 'Extract SBOMs'
       shell: pwsh
       run: > 
-        Get-ChildItem -Path ${{ env.nupkgDirectory }} -Filter *.nupkg -Force | ForEach-Object { 
+        Get-ChildItem -Path ${env:NUPKGDIRECTORY} -Filter *.nupkg -Force | ForEach-Object { 
           Expand-Archive $_.FullName "$($_.DirectoryName)/$($_.Basename)" -Force 
-          Copy-Item "$($_.DirectoryName)/$($_.Basename)/_manifest/spdx_2.2/manifest.spdx.json" -Destination "${{ env.nupkgDirectory }}/$($_.Basename).spdx.json"
-          Copy-Item "$($_.DirectoryName)/$($_.Basename)/_manifest/spdx_2.2/manifest.spdx.json.sha256" -Destination "${{ env.nupkgDirectory }}/$($_.Basename).spdx.json.sha256"
+          Copy-Item "$($_.DirectoryName)/$($_.Basename)/_manifest/spdx_2.2/manifest.spdx.json" -Destination "${env:NUPKGDIRECTORY}/$($_.Basename).spdx.json"
+          Copy-Item "$($_.DirectoryName)/$($_.Basename)/_manifest/spdx_2.2/manifest.spdx.json.sha256" -Destination "${env:NUPKGDIRECTORY}/$($_.Basename).spdx.json.sha256"
           Remove-Item "$($_.DirectoryName)/$($_.Basename)" -Force -Recurse }
 
     - name: 'List artifact directory'
       shell: pwsh
       run: >
-        Get-ChildItem -Path ${{ env.nupkgDirectory }} -Recurse -Force
+        Get-ChildItem -Path ${env:NUPKGDIRECTORY} -Recurse -Force
 
     - name: Upload unsigned nupkgs
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: build-artifacts
-        path: ${{ env.nupkgDirectory }}/*
+        path: ${NUPKGDIRECTORY}/*
         retention-days: 7
 
   sign:
@@ -106,12 +106,12 @@ jobs:
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: build-artifacts
-        path : ${{ env.nupkgDirectory }}
+        path : ${NUPKGDIRECTORY}
 
     - name: List assets to be signed
       shell: pwsh
       run: >
-        Get-ChildItem -Path ${{ env.nupkgDirectory }} -Include *.nupkg -Recurse -Force
+        Get-ChildItem -Path ${env:NUPKGDIRECTORY} -Include *.nupkg -Recurse -Force
 
     - name: Authenticate to Azure
       uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # 2.3.0
@@ -124,13 +124,13 @@ jobs:
     - name: Sign
       shell: pwsh
       run: >
-        ./sign/sign code azure-key-vault *.nupkg --base-directory ${{ env.nupkgDirectory }} --azure-key-vault-url "${{ secrets.AZURE_KEY_VAULT_URL }}" --azure-key-vault-certificate "${{ secrets.AZURE_KEY_VAULT_CERTIFICATE }}"
+        ./sign/sign code azure-key-vault *.nupkg --base-directory ${env:NUPKGDIRECTORY} --azure-key-vault-url "${{ secrets.AZURE_KEY_VAULT_URL }}" --azure-key-vault-certificate "${{ secrets.AZURE_KEY_VAULT_CERTIFICATE }}"
 
     - name: Upload signed nupkgs
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: signed-artifacts
-        path: ${{ env.nupkgDirectory }}/*
+        path: ${NUPKGDIRECTORY}/*
         retention-days: 7
 
   publish:
@@ -154,18 +154,18 @@ jobs:
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: signed-artifacts
-        path : ${{ env.nupkgDirectory }}
+        path : ${NUPKGDIRECTORY}
 
     - name: List assets to be published
       shell: pwsh
       run: >
-        Get-ChildItem -Path ${{ env.nupkgDirectory }} -Filter *.nupkg -Recurse -Force
+        Get-ChildItem -Path ${env:NUPKGDIRECTORY} -Filter *.nupkg -Recurse -Force
 
       # Use --skip-duplicate to prevent errors if a package with the same version already exists.
       # This allows a retory of a failed workflow, already published packages will be skipped without error.
     - name: Publish NuGet package
       shell: pwsh
       run: >
-        foreach($file in (Get-ChildItem "${{ env.nupkgDirectory }}" -Recurse -Filter *.nupkg)) {
+        foreach($file in (Get-ChildItem "${env:NUPKGDIRECTORY}" -Recurse -Filter *.nupkg)) {
           dotnet nuget push $file --api-key "${{ secrets.NUGET_APIKEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
         }

.github/workflows/upload-coverage-report.yml

@@ -25,6 +25,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
 		THIRD-PARTY-NOTICES.txt = THIRD-PARTY-NOTICES.txt
 		trimTest.ps1 = trimTest.ps1
 		version.json = version.json
+		zizmor.yml = zizmor.yml
 	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{C94F8041-6886-4D0F-82DC-8AF2B41FF649}"
@@ -73,7 +74,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "workflows", "workflows", "{
 		.github\workflows\codeql-analysis.yml = .github\workflows\codeql-analysis.yml
 		.github\workflows\dependency-review.yml = .github\workflows\dependency-review.yml
 		.github\workflows\generate-publish-docs.yml = .github\workflows\generate-publish-docs.yml
-		.github\workflows\upload-coverage-report.yml = .github\workflows\upload-coverage-report.yml
 	EndProjectSection
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Samples.Timeline", "samples\Samples.Timeline\Samples.Timeline.csproj", "{AB11676F-150A-4AD3-A34B-01AE0C9A1065}"