CI: address the zizmor workflow audit findings - #10281

Merged

ThomasWaldmann merged 7 commits into

borgbackup:masterfrom

ThomasWaldmann:zizmor-workflow-hardening

Aug 29, 2026

Commits on Aug 29, 2026

CI: pin the actions in the 32bit and bigendian workflows to commit SHAs

ThomasWaldmann
and
claude
committed
9901f20
CI: do not persist the checkout credentials where they are not needed

ThomasWaldmann
and
claude
committed
70fc87e
CI: build the release binaries without restoring caches

ThomasWaldmann
and
claude
committed
4b46dea
CI: pass matrix.binary to the shell via env, not by template expansion

ThomasWaldmann
and
claude
committed
3e78810
CI: document why the backport workflow uses pull_request_target

ThomasWaldmann
and
claude
committed
7b69f51
CI: move the accepted zizmor findings into .github/zizmor.yml

ThomasWaldmann
and
claude
committed
417c6c7
CI: scope the workflow token to the job that needs it

ThomasWaldmann
and
claude
committed
468cb70