black-sliver 2ee20a3ac4 CI: set permissions, update and pin actions, CodeQL for actions (#6073) ...

* CI: reduce default permissions to minimum

* CI: update pin actions

Most of them. CodeQL and action-gh-release is untouched for now.
Immutable actions and actions/* are pinned to version,
other actions are pinned to hash.

* CI: make use of archive: false in upload-artifact

also set compression level and error behavior for scan-build upload.

* CI: update codeql and enable scanning actions

2026-03-30 21:46:43 +02:00

4.6 KiB

Raw Blame History

View Raw