ci: resolve warnings and implement linter for GitHub Actions

.github/workflows/build-container.yml

@@ -188,10 +188,14 @@ jobs:
         env:
           TRUSTED: ${{ github.event_name == 'push' }}
           CONTEXT_TAG: ${{ inputs.context-tag }}
+          REPO_NAME: ${{ needs.build-amd64.outputs.repo }}
+          IMAGE_NAME: ${{ inputs.name }}
+          TAG: ${{ needs.build-amd64.outputs.tag }}
+          HASH_TAG: ${{ hashFiles(inputs.file) }}
+          AMD64_DIGEST: ${{ needs.build-amd64.outputs.digest }}
+          ARM64_DIGEST: ${{ needs.build-arm64.outputs.digest }}
         run: |
-          REPO="ghcr.io/${{ needs.build-amd64.outputs.repo }}/${{ inputs.name }}"
-          TAG="${{ needs.build-amd64.outputs.tag }}"
-          HASH_TAG="${{ hashFiles(inputs.file) }}"
+          REPO="ghcr.io/${REPO_NAME}/${IMAGE_NAME}"
 
           if [[ "$TRUSTED" == "true" ]]; then
             TAGS=(-t "${REPO}:${HASH_TAG}" -t "${REPO}:${TAG}" -t "${REPO}:latest")
@@ -205,8 +209,8 @@ jobs:
 
           # Use this run's digests: tags can be moved by concurrent runs
           docker buildx imagetools create --metadata-file "${RUNNER_TEMP}/manifest.json" "${TAGS[@]}" \
-            "${REPO}@${{ needs.build-amd64.outputs.digest }}" \
-            "${REPO}@${{ needs.build-arm64.outputs.digest }}"
+            "${REPO}@${AMD64_DIGEST}" \
+            "${REPO}@${ARM64_DIGEST}"
 
           DIGEST=$(jq -er '."containerimage.descriptor".digest' "${RUNNER_TEMP}/manifest.json")
           echo "path=${REPO}@${DIGEST}" >> "$GITHUB_OUTPUT"

.github/workflows/build-depends.yml

@@ -64,8 +64,11 @@ jobs:
 
       - name: Compute cache key
         id: setup
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
+          BASE_IMAGE_DIGEST: ${{ inputs.base-image-digest }}
+          RUNS_ON: ${{ inputs.runs-on }}
         run: |
-          BUILD_TARGET="${{ inputs.build-target }}"
           source ./ci/dash/matrix.sh
           echo "DEP_OPTS=${DEP_OPTS}" >> "${GITHUB_OUTPUT}"
           echo "HOST=${HOST}" >> "${GITHUB_OUTPUT}"
@@ -74,7 +77,7 @@ jobs:
           echo "DEP_HASH=${DEP_HASH}" >> "${GITHUB_OUTPUT}"
           DOCKERFILE_HASH="${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'contrib/containers/ci/ci-slim.Dockerfile') }}"
           DEPENDS_INPUTS_HASH="${{ hashFiles('depends/Makefile', 'depends/funcs.mk', 'depends/gen_id', 'depends/config.guess', 'depends/config.sub', 'depends/config.site.in', 'depends/builders/**', 'depends/hosts/**', 'depends/packages/**', 'depends/patches/**') }}"
-          CACHE_KEY_PREFIX="depends-${DOCKERFILE_HASH}-${{ inputs.base-image-digest }}-${{ inputs.runs-on }}-${{ inputs.build-target }}"
+          CACHE_KEY_PREFIX="depends-${DOCKERFILE_HASH}-${BASE_IMAGE_DIGEST}-${RUNS_ON}-${BUILD_TARGET}"
           CACHE_KEY="${CACHE_KEY_PREFIX}-${DEP_HASH}-${DEPENDS_INPUTS_HASH}"
           echo "cache-key-prefix=${CACHE_KEY_PREFIX}" >> "${GITHUB_OUTPUT}"
           echo "cache-key=${CACHE_KEY}" >> "${GITHUB_OUTPUT}"
@@ -127,7 +130,7 @@ jobs:
     outputs:
       built-artifact: depends-built-${{ inputs.build-target }}
     container:
-      image: ${{ inputs.container-path }}
+      image: ${{ inputs.container-path }} # zizmor: ignore[unpinned-images] built earlier in this run by build-container.yml
       options: --user root
     steps:
       - name: Checkout code
@@ -176,9 +179,14 @@ jobs:
             ${{ needs.check-cache.outputs.cache-key-prefix }}-
 
       - name: Build depends
+        env:
+          HOST: ${{ needs.check-cache.outputs.host }}
+          DEP_OPTS: ${{ needs.check-cache.outputs.dep-opts }}
         run: |
-          export HOST="${{ needs.check-cache.outputs.host }}"
-          env ${{ needs.check-cache.outputs.dep-opts }} make -j$(nproc) -C depends
+          # DEP_OPTS may contain shell-quoted values, e.g. CXX='clang++-19 -stdlib=libc++'
+          eval "DEP_OPTS_ARGS=(${DEP_OPTS})"
+          env "${DEP_OPTS_ARGS[@]}" make -j$(nproc) -C depends
+        shell: bash
 
       - name: Save depends cache
         # Cache tokens on untrusted triggers are read-only (GitHub change,

.github/workflows/build-src.yml

@@ -58,7 +58,7 @@ jobs:
       key:  ${{ steps.bundle.outputs.key }}
       freshness: ${{ steps.freshness.outputs.freshness }}
     container:
-      image: ${{ inputs.container-path }}
+      image: ${{ inputs.container-path }} # zizmor: ignore[unpinned-images] built earlier in this run by build-container.yml
       # SYS_PTRACE is required by LeakSanitizer's stop-the-world
       # (https://github.com/google/sanitizers/issues/764)
       options: --user root --cap-add SYS_PTRACE
@@ -73,13 +73,15 @@ jobs:
 
       - name: Initial setup
         id: setup
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha || '' }}
         run: |
           git config --global --add safe.directory "$PWD"
           git fetch -fu origin develop:develop
-          BUILD_TARGET="${{ inputs.build-target }}"
           source ./ci/dash/matrix.sh
           echo "HOST=${HOST}" >> $GITHUB_OUTPUT
-          echo "PR_BASE_SHA=${{ github.event.pull_request.base.sha || '' }}" >> $GITHUB_OUTPUT
+          echo "PR_BASE_SHA=${PR_BASE_SHA}" >> $GITHUB_OUTPUT
         shell: bash
 
       - name: Restore SDKs cache
@@ -131,10 +133,15 @@ jobs:
         shell: bash
 
       - name: Rebuild depends prefix
+        env:
+          DEPENDS_HOST: ${{ inputs.depends-host }}
+          DEP_OPTS: ${{ inputs.depends-dep-opts }}
         run: |
           # Use the HOST and DEP_OPTS from the depends build, not this build-target
           # This ensures the build_id matches the cached packages
-          make -j$(nproc) -C depends HOST="${{ inputs.depends-host }}" ${{ inputs.depends-dep-opts }}
+          # DEP_OPTS may contain shell-quoted values, e.g. CXX='clang++-19 -stdlib=libc++'
+          eval "DEP_OPTS_ARGS=(${DEP_OPTS})"
+          make -j$(nproc) -C depends HOST="${DEPENDS_HOST}" "${DEP_OPTS_ARGS[@]}"
         shell: bash
 
       - name: Restore ccache cache
@@ -185,6 +192,8 @@ jobs:
         shell: bash
 
       - name: Build source
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
         run: |
           # Nothing after this step needs to write to the remote cache, and the
           # tests run code built from cached objects; drop the credential even
@@ -194,7 +203,6 @@ jobs:
           CACHE_DIR="/cache"
           mkdir /output
           BASE_OUTDIR="/output"
-          BUILD_TARGET="${{ inputs.build-target }}"
           source ./ci/dash/matrix.sh
           ./ci/dash/build_src.sh
           { echo "### ccache: ${BUILD_TARGET}"; echo '```'; ccache --show-stats; echo '```'; } >> "${GITHUB_STEP_SUMMARY}"
@@ -226,9 +234,10 @@ jobs:
 
       - name: Run linters
         if: inputs.build-target == 'linux64_multiprocess'
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
         run: |
           CACHE_DIR="/cache"
-          export BUILD_TARGET="${{ inputs.build-target }}"
           source ./ci/dash/matrix.sh
           ./ci/dash/lint-tidy.sh
         shell: bash
@@ -245,16 +254,18 @@ jobs:
           key: ctcache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-${{ github.sha }}
 
       - name: Run unit tests
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
         run: |
-          BUILD_TARGET="${{ inputs.build-target }}"
           source ./ci/dash/matrix.sh
           ./ci/dash/test_unittests.sh
         shell: bash
 
       - name: Bundle artifacts
         id: bundle
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
         run: |
-          export BUILD_TARGET="${{ inputs.build-target }}"
           export BUNDLE_KEY="build-${BUILD_TARGET}-$(git rev-parse --short=8 HEAD)"
           find "build-ci/dashcore-${BUILD_TARGET}/src/" -name "*.a" -type f -delete
           find "build-ci/dashcore-${BUILD_TARGET}/src/" -name "*.o" -type f -delete

.github/workflows/build.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] CI for fork PRs; PR code runs with a read-only token except the container image builds
 
 permissions:
   actions: read
@@ -53,11 +53,14 @@ jobs:
     steps:
       - name: Check skip environment variables
         id: skip-check
+        env:
+          SKIP_ON_PUSH: ${{ vars.SKIP_ON_PUSH }}
+          SKIP_ON_PR: ${{ vars.SKIP_ON_PR }}
         run: |
-          if [[ "${{ github.event_name }}" == "push" && "${{ vars.SKIP_ON_PUSH }}" != "" ]]; then
+          if [[ "${GITHUB_EVENT_NAME}" == "push" && "${SKIP_ON_PUSH}" != "" ]]; then
             echo "Skipping build on push due to SKIP_ON_PUSH environment variable"
             echo "skip=true" >> $GITHUB_OUTPUT
-          elif [[ "${{ github.event_name }}" == "pull_request_target" && "${{ vars.SKIP_ON_PR }}" != "" ]]; then
+          elif [[ "${GITHUB_EVENT_NAME}" == "pull_request_target" && "${SKIP_ON_PR}" != "" ]]; then
             echo "Skipping build on pull request due to SKIP_ON_PR environment variable"
             echo "skip=true" >> $GITHUB_OUTPUT
           else
@@ -67,6 +70,8 @@ jobs:
       - name: Checkout code
         if: ${{ steps.skip-check.outputs.skip == 'false' }}
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Select runners
         id: select-runner

.github/workflows/cache-depends-sources.yml

@@ -12,6 +12,9 @@ on:
     # Run daily at 6 AM UTC on the default branch to keep cache warm
     - cron: '0 6 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   cache-sources:
     name: Cache depends sources

.github/workflows/clang-diff-format.yml

@@ -4,12 +4,18 @@ on:
   pull_request:
     branches:
       - develop
+
+permissions:
+  contents: read
+
 jobs:
   ClangFormat:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Fetch git
         run: git fetch --no-tags -fu origin develop:develop
       - name: Run Clang-Format-Diff.py

.github/workflows/guix-build.yml

@@ -1,12 +1,9 @@
 name: Guix Build
 
-permissions:
-  packages: read
-  id-token: write
-  attestations: write
+permissions: {}
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] runs only when a maintainer applies the 'guix-build' label
     types: [labeled]
   push:
   schedule:
@@ -83,6 +80,10 @@ jobs:
     needs: build-image
     # runs-on: [ "self-hosted", "linux", "x64", "ubuntu-core" ]
     runs-on: ubuntu-24.04-arm
+    permissions:
+      packages: read
+      id-token: write
+      attestations: write
     strategy:
       matrix:
         build_target: [x86_64-linux-gnu, aarch64-linux-gnu, riscv64-linux-gnu, powerpc64-linux-gnu, x86_64-w64-mingw32, x86_64-apple-darwin, arm64-apple-darwin]
@@ -130,14 +131,17 @@ jobs:
 
       - name: Run Guix build
         timeout-minutes: 480
+        env:
+          IMAGE: ${{ needs.build-image.outputs.image }}
+          BUILD_TARGET: ${{ matrix.build_target }}
         run: |
           docker run --privileged -d --rm -t \
             --name guix-daemon \
-            -v ${{ github.workspace }}/dash:/src/dash \
-            -v ${{ github.workspace }}/.cache:/home/ubuntu/.cache \
+            -v "${GITHUB_WORKSPACE}/dash:/src/dash" \
+            -v "${GITHUB_WORKSPACE}/.cache:/home/ubuntu/.cache" \
             -w /src/dash \
-            ${{ needs.build-image.outputs.image }} && \
-          docker exec guix-daemon bash -c 'HOSTS=${{ matrix.build_target }} /usr/local/bin/guix-start /src/dash'
+            "${IMAGE}" && \
+          docker exec -e HOSTS="${BUILD_TARGET}" guix-daemon bash -c '/usr/local/bin/guix-start /src/dash'
 
       - name: Ensure build passes
         run: |
@@ -148,8 +152,10 @@ jobs:
 
       - name: Compute SHA256 checksums
         continue-on-error: true # It will complain on depending on only some hosts
+        env:
+          HOSTS: ${{ matrix.build_target }}
         run: |
-          HOSTS=${{ matrix.build_target }} ./dash/contrib/containers/guix/scripts/guix-check ${{ github.workspace }}/dash
+          ./dash/contrib/containers/guix/scripts/guix-check "${GITHUB_WORKSPACE}/dash"
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@v6

.github/workflows/label-merge-conflicts.yml

@@ -5,7 +5,7 @@ on:
   # So that the `dirtyLabel` is removed if conflicts are resolve
   # We recommend `pull_request_target` so that github secrets are available.
   # In `pull_request` we wouldn't be able to change labels of fork PRs
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] needs a write token to label fork PRs; does not check out PR code
     types: [synchronize]
 
 permissions:

.github/workflows/lint.yml

@@ -23,7 +23,7 @@ jobs:
     outputs:
       freshness: ${{ steps.freshness.outputs.freshness }}
     container:
-      image: ${{ inputs.container-path }}
+      image: ${{ inputs.container-path }} # zizmor: ignore[unpinned-images] built earlier in this run by build-container.yml
       options: --user root
     steps:
       - name: Checkout code
@@ -56,10 +56,10 @@ jobs:
           export CHECK_DOC=1
 
           # Determine if this is a PR and set commit range accordingly
-          if [ "${{ github.event_name }}" = "pull_request_target" ]; then
+          if [ "${GITHUB_EVENT_NAME}" = "pull_request_target" ]; then
             export COMMIT_RANGE="$(git merge-base origin/develop HEAD)..HEAD"
             export PULL_REQUEST="true"
-          elif [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref }}" != "refs/heads/develop" ] && [ "${{ github.ref }}" != "refs/heads/master" ]; then
+          elif [ "${GITHUB_EVENT_NAME}" = "push" ] && [ "${GITHUB_REF}" != "refs/heads/develop" ] && [ "${GITHUB_REF}" != "refs/heads/master" ]; then
             # For push events on feature branches, check against develop
             export COMMIT_RANGE="$(git merge-base origin/develop HEAD)..HEAD"
             export PULL_REQUEST="true"
@@ -69,8 +69,8 @@ jobs:
             export PULL_REQUEST="false"
           fi
 
-          echo "Event name: ${{ github.event_name }}"
-          echo "Ref: ${{ github.ref }}"
+          echo "Event name: ${GITHUB_EVENT_NAME}"
+          echo "Ref: ${GITHUB_REF}"
           echo "COMMIT_RANGE=${COMMIT_RANGE}"
           echo "PULL_REQUEST=${PULL_REQUEST}"
           echo "Running git log for commit range:"

.github/workflows/merge-check.yml

@@ -8,7 +8,7 @@ permissions:
 
 on:
   push:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] fetches the PR head only to test a fast-forward merge; runs no PR code
   pull_request_review:
     types: [submitted]
 
@@ -20,27 +20,31 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Git
         run: |
           git config user.name "GitHub Action"
           git config user.email "noreply@example.com"
 
       - name: Check merge --ff-only
+        env:
+          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          if [[ "${{ github.ref_name }}" == "master" ]]; then
+          if [[ "${GITHUB_REF_NAME}" == "master" ]]; then
             echo "Already on master, no need to check --ff-only"
           else
             git fetch --no-tags origin master:master
-            if [[ "${{ github.event_name }}" == "pull_request"* ]]; then
-              git fetch --no-tags origin ${{ github.event.pull_request.base.ref }}:base_branch
+            if [[ "${GITHUB_EVENT_NAME}" == "pull_request"* ]]; then
+              git fetch --no-tags origin "${PR_BASE_REF}:base_branch"
               git checkout base_branch
-              git pull --rebase=false origin pull/${{ github.event.pull_request.number }}/head
+              git pull --rebase=false origin "pull/${PR_NUMBER}/head"
               git checkout master
               git merge --ff-only base_branch
             else
               git checkout master
-              git merge --ff-only ${{ github.sha }}
+              git merge --ff-only "${GITHUB_SHA}"
             fi
           fi
 

.github/workflows/predict-conflicts.yml

@@ -1,7 +1,7 @@
 name: "Check Potential Conflicts"
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] needs a write token to comment on fork PRs; runs base-branch code only
     types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
   pull_request_review:
     types: [submitted]