ops: Resolve most zizmor findings as of zizmor@1.31.1

.github/actions/checkout-rust/action.yml

@@ -23,7 +23,7 @@ runs:
         fi
         echo "commit=$commit" >> "$GITHUB_OUTPUT"
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: rust-lang/rust
         ref: ${{ steps.toolchain.outputs.commit }}

.github/actions/rustup-cg-gcc/action.yml

@@ -30,7 +30,7 @@ runs:
         echo "commit=$commit" >> "$GITHUB_OUTPUT"
         echo "Tested the cg_gcc of nightly-$date ([rust-lang/rust@${commit:0:11}](https://github.com/rust-lang/rust/commit/$commit))." >> "$GITHUB_STEP_SUMMARY"
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: rust-lang/rust
         ref: ${{ steps.nightly.outputs.commit }}

.github/workflows/ci.yml

@@ -56,17 +56,19 @@ jobs:
             commands: "--librsvg-tests"
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       # `llvm-tools` is needed to install the `FileCheck` binary which is used for asm tests.
@@ -81,12 +83,18 @@ jobs:
       run: sudo apt-get install libcairo2-dev libpango1.0-dev libfontconfig1-dev libfreetype-dev libharfbuzz-dev libxml2-dev libglib2.0-dev
 
     - name: Download artifact
-      run: curl -LO https://github.com/rust-lang/gcc/releases/latest/download/${{ matrix.libgccjit_version.gcc }}${{ matrix.os.asset_name_suffix }}.deb
+      run: curl -LO https://github.com/rust-lang/gcc/releases/latest/download/${LIBGCCJIT_GCC}${ASSET_NAME_SUFFIX}.deb
+      env:
+        ASSET_NAME_SUFFIX: ${{ matrix.os.asset_name_suffix }}
+        LIBGCCJIT_GCC: ${{ matrix.libgccjit_version.gcc }}
 
     - name: Setup path to libgccjit
       run: |
-          sudo dpkg --force-overwrite -i ${{ matrix.libgccjit_version.gcc }}${{ matrix.os.asset_name_suffix }}.deb
+          sudo dpkg --force-overwrite -i ${LIBGCCJIT_GCC}${ASSET_NAME_SUFFIX}.deb
           echo 'gcc-path = "/usr/lib/"' > config.toml
+      env:
+        ASSET_NAME_SUFFIX: ${{ matrix.os.asset_name_suffix }}
+        LIBGCCJIT_GCC: ${{ matrix.libgccjit_version.gcc }}
 
     # Some run-make tests fail if we use our forked GCC because it doesn't
     # bundle libstdc++, so we switch to gcc-14 to have a GCC that has
@@ -149,9 +157,11 @@ jobs:
         ./y.sh test --cargo-tests
         CARGO_TEST_FLAGS="-Zmir-preserve-ub" ./y.sh test --cargo-tests -- mir_preserve_ub_empty_switch
         # The lock-free 128-bit atomics need native 128-bit integers.
-        if [ "${{ matrix.libgccjit_version.gcc }}" != "gcc-15-without-int128" ]; then
+        if [ "${LIBGCCJIT_GCC}" != "gcc-15-without-int128" ]; then
           CARGO_TEST_FLAGS="-Ctarget-feature=+cmpxchg16b" ./y.sh test --cargo-tests -- atomic_u128
         fi
+      env:
+        LIBGCCJIT_GCC: ${{ matrix.libgccjit_version.gcc }}
 
     - name: Run y.sh cargo build
       if: ${{ matrix.run_checks }}
@@ -175,22 +185,28 @@ jobs:
 
     - name: Check out rust-lang/rust
       if: ${{ contains(matrix.commands, '-rustc') }}
-      uses: ./.github/actions/checkout-rust
+      uses: $/.github/actions/checkout-rust
 
     - name: Run tests
       run: |
-        ./y.sh test --release --clean --build-sysroot --no-builtins-tests ${{ matrix.commands }}
+        ./y.sh test --release --clean --build-sysroot --no-builtins-tests ${MATRIX_COMMANDS}
+      env:
+        MATRIX_COMMANDS: ${{ matrix.commands }}
 
   duplicates:
     runs-on: ubuntu-26.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - run: python tools/check_intrinsics_duplicates.py
 
   build_system:
     runs-on: ubuntu-26.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Test build system
         run: |
           cd build_system
@@ -211,6 +227,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}

.github/workflows/failures.yml

@@ -36,17 +36,19 @@ jobs:
             env_extra: "TEST_FLAGS='-Cpanic=abort -Zpanic-abort-tests' GCC_EXEC_PREFIX=/usr/lib/gcc/"
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       timeout-minutes: 20
@@ -102,40 +104,50 @@ jobs:
 
     - name: Check out rust-lang/rust
       if: matrix.libgccjit_version.gcc != 'libgccjit12.so'
-      uses: ./.github/actions/checkout-rust
+      uses: $/.github/actions/checkout-rust
 
     - name: Run tests
       # FIXME: re-enable those tests for libgccjit 12.
       if: matrix.libgccjit_version.gcc != 'libgccjit12.so'
       id: tests
+      # Without `set -o pipefail`, `tee` masks the exit status of `y.sh test`.
+      # This suite runs the tests known to fail, so only a build system error must fail the job.
       run: |
-        # Without this, `tee` masks the exit status of `y.sh test`.
+        bash <<-EOF
         set -o pipefail
         status=0
-        ${{ matrix.libgccjit_version.env_extra }} ./y.sh test --release --clean --build-sysroot --test-failing-rustc ${{ matrix.libgccjit_version.extra }} 2>&1 | tee output_log || status=$?
-        # This suite runs the tests known to fail, so only a build system error must fail the job.
+        ${LIBGCCJIT_ENV_EXTRA} ./y.sh test --release --clean --build-sysroot --test-failing-rustc ${LIBGCCJIT_EXTRA} 2>&1 | tee output_log || status=$?
         if [ "$status" -ne 0 ] && [ "$status" -ne 2 ]; then
           exit "$status"
         fi
         rg --text "test result" output_log >> $GITHUB_STEP_SUMMARY
+        EOF
+      env:
+        LIBGCCJIT_EXTRA: ${{ matrix.libgccjit_version.extra }}
+        LIBGCCJIT_ENV_EXTRA: ${{ matrix.libgccjit_version.env_extra }}
 
     - name: Run failing ui pattern tests for ICE
       # FIXME: re-enable those tests for libgccjit 12.
       if: matrix.libgccjit_version.gcc != 'libgccjit12.so'
       id: ui-tests
+      # Without `set -o pipefail`, `tee` masks the exit status of `y.sh test`.
+      # This suite runs tests that fail, so only a build system error must fail the job here.
       run: |
-        # Without this, `tee` masks the exit status of `y.sh test`.
+        bash <<-EOF
         set -o pipefail
         status=0
-        ${{ matrix.libgccjit_version.env_extra }} ./y.sh test --release --test-failing-ui-pattern-tests ${{ matrix.libgccjit_version.extra }} 2>&1 | tee output_log_ui || status=$?
-        # This suite runs tests that fail, so only a build system error must fail the job here.
+        ${LIBGCCJIT_ENV_EXTRA} ./y.sh test --release --test-failing-ui-pattern-tests ${LIBGCCJIT_EXTRA} 2>&1 | tee output_log_ui || status=$?
         if [ "$status" -ne 0 ] && [ "$status" -ne 2 ]; then
           exit "$status"
         fi
         if grep -q "the compiler unexpectedly panicked" output_log_ui; then
           echo "Error: 'the compiler unexpectedly panicked' found in output logs. CI Error!!"
           exit 1
         fi
+        EOF
+      env:
+        LIBGCCJIT_EXTRA: ${{ matrix.libgccjit_version.extra }}
+        LIBGCCJIT_ENV_EXTRA: ${{ matrix.libgccjit_version.env_extra }}
 
   # Summary job for the merge queue.
   # ALL THE PREVIOUS JOBS NEED TO BE ADDED TO THE `needs` SECTION OF THIS JOB!
@@ -152,6 +164,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}

.github/workflows/gcc12.yml

@@ -37,17 +37,19 @@ jobs:
         ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       # `llvm-tools` is needed to install the `FileCheck` binary which is used for asm tests.
@@ -105,6 +107,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}

.github/workflows/m68k.yml

@@ -34,17 +34,19 @@ jobs:
         ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       timeout-minutes: 20
@@ -85,9 +87,11 @@ jobs:
     - name: Build sample project with target defined as JSON spec
       run: |
         ./y.sh prepare --only-libcore --cross
-        ./y.sh build --sysroot --target-triple m68k-unknown-linux-gnu --target ${{ github.workspace }}/target_specs/m68k-unknown-linux-gnu.json
-        CARGO_PROFILE_DEV_LTO=no CG_RUSTFLAGS="-Clinker=m68k-unknown-linux-gnu-gcc" ./y.sh cargo build -Zjson-target-spec --manifest-path=./tests/hello-world/Cargo.toml --target ${{ github.workspace }}/target_specs/m68k-unknown-linux-gnu.json
+        ./y.sh build --sysroot --target-triple m68k-unknown-linux-gnu --target ${GH_WORKSPACE}/target_specs/m68k-unknown-linux-gnu.json
+        CARGO_PROFILE_DEV_LTO=no CG_RUSTFLAGS="-Clinker=m68k-unknown-linux-gnu-gcc" ./y.sh cargo build -Zjson-target-spec --manifest-path=./tests/hello-world/Cargo.toml --target ${GH_WORKSPACE}/target_specs/m68k-unknown-linux-gnu.json
         ./y.sh clean all
+      env:
+        GH_WORKSPACE: ${{ github.workspace }}
 
     - name: Build
       run: |
@@ -105,7 +109,9 @@ jobs:
 
     - name: Run tests
       run: |
-        ./y.sh test --target-triple m68k-unknown-linux-gnu --release --clean --build-sysroot ${{ matrix.commands }}
+        ./y.sh test --target-triple m68k-unknown-linux-gnu --release --clean --build-sysroot ${MATRIX_COMMANDS}
+      env:
+        MATRIX_COMMANDS: ${{ matrix.commands }}
 
     - name: Run Hello World!
       run: |
@@ -134,6 +140,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}

.github/workflows/release.yml

@@ -30,17 +30,19 @@ jobs:
         ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       # `llvm-tools` is needed to install the `FileCheck` binary which is used for run-make tests.
@@ -84,12 +86,14 @@ jobs:
       run: cat tests/failing-lto-tests.txt >> tests/failing-ui-tests.txt
 
     - name: Check out rust-lang/rust
-      uses: ./.github/actions/checkout-rust
+      uses: $/.github/actions/checkout-rust
 
     - name: Run tests
       run: |
         # FIXME(antoyo): we cannot enable LTO for stdarch tests currently because of some failing LTO tests using proc-macros.
-        CG_RUSTFLAGS="-Cembed-bitcode=yes" ./y.sh test --release --clean --release-sysroot --build-sysroot --keep-lto-tests ${{ matrix.commands }}
+        CG_RUSTFLAGS="-Cembed-bitcode=yes" ./y.sh test --release --clean --release-sysroot --build-sysroot --keep-lto-tests ${MATRIX_COMMANDS}
+      env:
+        MATRIX_COMMANDS: ${{ matrix.commands }}
 
     - name: LTO test
       run: |
@@ -131,6 +135,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}