Fix GitHub Actions with hints from zizmor

Author: oherrala

.github/workflows/rust_matrix.yml

@@ -1,10 +1,13 @@
+name: Rust Matrix CI
+
 on:
   push:
     branches: [ main ]
   pull_request:
     branches: [ main ]
 
-name: Rust Matrix CI
+permissions:
+  contents: read
 
 jobs:
   test-matrix:
@@ -22,7 +25,9 @@ jobs:
       - name: Install dependencies
         run: sudo apt -y update && sudo apt -y install flex bison
         if: ${{ startsWith(matrix.os, 'ubuntu') }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: sensorfu/setup-rust-action@v1
         with:
           cache-key: ${{ matrix.os }}-${{ matrix.toolchain }}
@@ -41,7 +46,9 @@ jobs:
           - x86_64-unknown-linux-musl
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: sensorfu/setup-rust-action@v1
         with:
           cache-key: ${{ matrix.target }}

.github/workflows/rust_sanitizers.yml

@@ -1,10 +1,13 @@
+name: Sanitizers
+
 on:
   push:
     branches: [ main ]
   pull_request:
     branches: [ main ]
 
-name: Run Sanitizers
+permissions:
+  contents: read
 
 jobs:
   sanitizers:
@@ -13,21 +16,26 @@ jobs:
       matrix:
         os: [ ubuntu-latest, macos-latest ]
         sanitizer: [ address ]
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: macos-latest
+            target: aarch64-apple-darwin
 
     steps:
       - name: Install dependencies
         run: sudo apt -y update && sudo apt -y install flex bison
         if: ${{ startsWith(matrix.os, 'ubuntu') }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: sensorfu/setup-rust-action@v1
         with:
           toolchain: nightly
           components: rust-src
-      - run: |
-          echo "TARGET=$(rustc -vV | awk '/^host: / { print $2 }')" >>${GITHUB_ENV}
-      - name: Run ${{ matrix.sanitizer }} sanitizer for ${{ env.TARGET }}
+      - name: Run ${{ matrix.sanitizer }} sanitizer for ${{ matrix.target }}
         env:
           RUSTFLAGS: -Z sanitizer=${{ matrix.sanitizer }}
           RUSTDOCFLAGS: -Z sanitizer=${{ matrix.sanitizer }}
           ASAN_OPTIONS: verbose=1:atexit=1:detect_stack_use_after_return=1:strict_string_checks=1
-        run: cargo test -Zbuild-std --target ${{ env.TARGET }}
+        run: cargo test -Zbuild-std --target ${{ matrix.target }}

.github/workflows/rust_stable.yml

@@ -1,18 +1,23 @@
+name: Rust Stable CI
+
 on:
   push:
     branches: [ main ]
   pull_request:
     branches: [ main ]
 
-name: Rust Stable CI
+permissions:
+  contents: read
 
 jobs:
   lints:
     runs-on: ubuntu-latest
     steps:
       - name: Install dependencies
         run: sudo apt -y update && sudo apt -y install flex bison
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: sensorfu/setup-rust-action@v1
         with:
           components: clippy,rustfmt

zizmor.yml

@@ -0,0 +1,8 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Allow using GitHub Actions' own actions with just version tag
+        actions/*: ref-pin
+        # Allow using our own actions with just version tag
+        sensorfu/*: ref-pin