test

Author: userdocs

.github/workflows/ci-checks.yml

@@ -8,11 +8,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   sh-checker:
     runs-on: ubuntu-24.04-arm
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
@@ -31,32 +31,18 @@ jobs:
   zizmor-checker:
     runs-on: ubuntu-24.04-arm
     permissions:
-      contents: read
+      security-events: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
-      - name: Check GitHub Action workflows
-        shell: bash {0}
-        run: |
-          pip install zizmor
-
-          zizmor="$(zizmor . --gh-token "${{ github.token }}")"
-          exit_code="$?"
-
-          printf '%s\n' "$zizmor"
-
-          printf '%b\n' "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          printf '%s\n' "$zizmor" >> $GITHUB_STEP_SUMMARY
-          printf '%b' "\`\`\`" >> $GITHUB_STEP_SUMMARY
-
-          exit "$exit_code"
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5ca5fc7a4779c5263a3ffa0e1f693009994446d1 # v0.1.2
 
   editorconfig-checker:
     runs-on: ubuntu-24.04-arm
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:

.github/workflows/cmake-ninja-crossbuild.yml

@@ -34,11 +34,9 @@ jobs:
       matrix:
         name: [cmake]
         os_id: [debian, ubuntu]
-        os_codename: [bullseye, bookworm, focal, jammy, noble]
+        os_codename: [bullseye, bookworm, trixie, jammy, noble]
         arch: [amd64, armhf, arm64]
         exclude:
-          - os_id: debian
-            os_codename: focal
           - os_id: debian
             os_codename: jammy
           - os_id: debian
@@ -47,6 +45,8 @@ jobs:
             os_codename: bullseye
           - os_id: ubuntu
             os_codename: bookworm
+          - os_id: ubuntu
+            os_codename: trixie
 
     name: ${{ matrix.os_id }}:${{ matrix.os_codename }} ${{ matrix.name }} ${{ matrix.arch }}
 
@@ -62,10 +62,10 @@ jobs:
           persist-credentials: false
 
       - name: Host - Bootstrap qemu
-        uses: userdocs/actions/qemu@main
+        uses: userdocs/actions/qemu@e74d179578ddcf1cd07cd9eefd0915f33a3bd600 # v1.0.1
 
       - name: Host - Create docker multiarch ${{ matrix.arch }} container
-        run: docker run --name multiarch -it -d -v ${{ github.workspace }}:/home/github ghcr.io/userdocs/dcb:${{ matrix.os_id }}-${{ matrix.os_codename }}-${{ matrix.arch }}
+        run: docker run --name multiarch -it -d -v ${{ github.workspace }}:/home/gh ghcr.io/userdocs/dcb:${{ matrix.os_id }}-${{ matrix.os_codename }}-${{ matrix.arch }}
 
       - name: Host - cmake set cmake_github_tag
         run: printf '%s\n' "cmake_github_tag=$(git ls-remote -q -t --refs https://github.com/Kitware/CMake.git | awk '{sub("refs/tags/", "");sub("(.*)-rc(.*)", ""); print $2 }' | awk '!/^$/' | sort -rV | head -n 1)" >> $GITHUB_ENV
@@ -77,35 +77,35 @@ jobs:
         run: git clone --single-branch --branch ${cmake_github_tag} --shallow-submodules --recurse-submodules --depth 1 https://github.com/Kitware/CMake.git cmake
 
       - name: Docker - Configure cmake
-        run: docker exec -u github:github -w /home/github/cmake multiarch ./configure --parallel=$(nproc) --no-system-libs --enable-ccache --prefix=/home/github/build/${opt_dir_name}
+        run: docker exec -u gh:gh -w /home/gh/cmake multiarch ./configure --parallel=$(nproc) --no-system-libs --enable-ccache --prefix=/home/gh/build/${opt_dir_name}
 
       - name: Docker - Make build cmake
-        run: docker exec -u github:github -w /home/github/cmake multiarch make -j $(nproc)
+        run: docker exec -u gh:gh -w /home/gh/cmake multiarch make -j $(nproc)
 
       - name: Docker - Make install cmake
-        run: docker exec -u github:github -w /home/github/cmake multiarch make install
+        run: docker exec -u gh:gh -w /home/gh/cmake multiarch make install
 
       - name: Host - Git clone ninja
         run: git clone --single-branch --branch ${ninja_github_tag} --shallow-submodules --recurse-submodules --depth 1 https://github.com/ninja-build/ninja.git ninja
 
       - name: Docker - Configure ninja
         run: >
-          docker exec -u github:github -w /home/github/ninja multiarch /home/github/build/${opt_dir_name}/bin/cmake -B build
+          docker exec -u gh:gh -w /home/gh/ninja multiarch "/home/gh/build/${opt_dir_name}/bin/cmake" -B build
           -D CMAKE_BUILD_TYPE="release"
           -D CMAKE_CXX_STANDARD="${cxx_standard}"
-          -D CMAKE_INSTALL_PREFIX="/home/github/build/${opt_dir_name}"
+          -D CMAKE_INSTALL_PREFIX="/home/gh/build/${opt_dir_name}"
           -D BUILD_TESTING=off
 
       - name: Docker - Build ninja
-        run: docker exec -u github:github -w /home/github/ninja multiarch /home/github/build/${opt_dir_name}/bin/cmake --build build -j"$(nproc)"
+        run: docker exec -u gh:gh -w /home/gh/ninja multiarch "/home/gh/build/${opt_dir_name}/bin/cmake" --build build -j"$(nproc)"
 
       - name: Docker - Install ninja
-        run: docker exec -u github:github -w /home/github/ninja multiarch /home/github/build/${opt_dir_name}/bin/cmake --install build
+        run: docker exec -u gh:gh -w /home/gh/ninja multiarch "/home/gh/build/${opt_dir_name}/bin/cmake" --install build
 
       - name: Docker - Test cmake and ninja binaries and set versions
         run: |
-          docker exec -u github:github -w /home/github multiarch bash -c '/home/github/build/${opt_dir_name}/bin/cmake --version 2> /dev/null | awk "NR==1{print \$3}" > cmake.version'
-          docker exec -u github:github -w /home/github multiarch bash -c '/home/github/build/${opt_dir_name}/bin/ninja --version 2> /dev/null > ninja.version'
+          docker exec -u gh:gh -w /home/gh multiarch bash -c '/home/gh/build/'"${opt_dir_name}"'/bin/cmake --version 2> /dev/null | awk "NR==1{print \$3}" > cmake.version'
+          docker exec -u gh:gh -w /home/gh multiarch bash -c '/home/gh/build/'"${opt_dir_name}"'/bin/ninja --version 2> /dev/null > ninja.version'
 
       - name: Host - Set cmake and ninja versions to variable
         id: version_info