CI: set permissions, update and pin actions, CodeQL for actions (#6073)

* CI: reduce default permissions to minimum

* CI: update pin actions

Most of them. CodeQL and action-gh-release is untouched for now.
Immutable actions and actions/* are pinned to version,
other actions are pinned to hash.

* CI: make use of archive: false in upload-artifact

also set compression level and error behavior for scan-build upload.

* CI: update codeql and enable scanning actions
This commit is contained in:
black-sliver
2026-03-30 19:46:43 +00:00
committed by GitHub
parent c640d2fa24
commit 2ee20a3ac4
10 changed files with 71 additions and 50 deletions

View File

@@ -14,7 +14,7 @@ jobs:
name: 'Apply content-based labels'
runs-on: ubuntu-latest
steps:
- uses: actions/labeler@v5
- uses: actions/labeler@v6.0.1
with:
sync-labels: false
peer_review: