Tatsh / bfcodec

100%

LAST BUILD ON BRANCH master

branch: SELECT

CHANGE BRANCH

x

Sync Branches

• No branch selected
• copilot/fix-action-run-issues
• copilot/resolve-action-run-issue
• dependabot/github_actions/actions/attest-build-provenance-4
• dependabot/github_actions/actions/configure-pages-6
• dependabot/github_actions/actions/deploy-pages-5
• dependabot/github_actions/actions/upload-artifact-7
• dependabot/github_actions/actions/upload-pages-artifact-5
• dependabot/github_actions/softprops/action-gh-release-3
• dependabot/npm_and_yarn/cspell-10.0.0
• dependabot/npm_and_yarn/development-3679be669f
• dependabot/npm_and_yarn/development-772c6b9025
• dependabot/npm_and_yarn/npm_and_yarn-66413a1f6e
• dependabot/npm_and_yarn/npm_and_yarn-e5a595f223
• dependabot/npm_and_yarn/prettier-3.8.2
• dependabot/npm_and_yarn/prettier-3.8.3
• dependabot/vcpkg/https-/github.com/microsoft/vcpkg-2026.04.27
• dependabot/vcpkg/https-/github.com/microsoft/vcpkg-2026.05.25
• master
• pre-commit-ci-update-config

Build # 27394232283

Build Type

push

github

Committed by Tatsh

Commit Message

workflows/*: pin actions and harden hand-maintained workflows for zizmor

These workflows are not generated by Wiswa (want_codeql, want_tests,
and the cmake, flatpak, snap, pages, and release workflows are all
hand-maintained), so they missed the SHA pinning Wiswa applies to its
generated workflows. Bring them up to the same standard so zizmor
passes:

- Pin every action reference to a commit SHA.
- Set persist-credentials: false on every checkout.
- codeql: switch the language matrix from the legacy cpp to c-cpp plus
  actions, drive the build with build-mode (autobuild for c-cpp, none
  for actions), and drop the standalone autobuild step.
- release: write the resolved tag to the step output instead of
  GITHUB_ENV and read it back through env in the publish step,
  resolving the github-env finding.
- snap: replace softprops/action-gh-release with a gh release script
  step.
- flatpak: keep softprops (pinned) because the job runs inside the
  flathub container, which does not provide the gh CLI; suppress the
  info-level superfluous-actions finding for flatpak.yml in
  .github/zizmor.yml.

Signed-off-by: Andrew Udvare <audvare@gmail.com>

Coverage Stats

129 of 129 relevant lines covered (100.0%)

7281.89 hits per line