Add actionlint, zizmor lints and repo-sync workflow by samuelburnham · Pull Request #87 · argumentcomputer/ci-workflows

samuelburnham · 2026-08-24T15:28:56Z

No description provided.

Add an `actionlint` + `zizmor` composite action and a `lint.yml` that runs it over this repo, with config for the org's self-hosted runner labels and for the zizmor rules that don't apply here. Fix what those linters found: - Move `github.event.*` interpolations into `env:` in `bench-pr-comment.yml` and `gpu-bench.yml` so untrusted input can't be injected into `run:`. - Migrate the deprecated `tibdex/github-app-token` to `actions/create-github-app-token` in `typos.yml`, and request explicit token permissions there and in `repo-sync.yml`. - Quote the `FILE_PATHS` assignment in `typos.yml`. - Drop `if $(...)` command substitution in `lints.yml`. - Remove the `type:` key from a composite action input, which Actions does not support. Remove the `benchmark-plotter` and `check-downstream-compiles` crates along with their only consumers, `bench-deploy.yml`, `ci.yml`, and the `check-downstream-compiles` action. Give Dependabot a 7-day cooldown before opening update PRs.

The new lint job surfaced ~200 findings in workflows and actions that predate it. Fix them rather than suppress them: - Move `inputs.*`, `env.*`, and `github.*` interpolations out of `run:` blocks and into `env:`, so untrusted values reach the shell as variables instead of being spliced into the script. Where a value is read back from `$GITHUB_ENV` it becomes a plain shell variable, and `github.sha`/`github.repository` use the runner's own `GITHUB_*` vars. - Set `persist-credentials: false` on checkouts that don't push. The primary checkout in `gpu-bench.yml` keeps its credentials, since `git-auto-commit-action` pushes with them; every other push path authenticates with an explicit token. - Annotate the remaining findings inline with a rationale: `GITHUB_ENV` writes that pass state between steps of a composite action, and `ncipollo/release-action`, whose `allowUpdates` behavior `gh release` does not provide. `continue-on-error` is silently ignored on composite action steps, so zizmor could never have been advisory as its input claimed. Drop the `zizmor-advisory` input and document that findings fail the caller. Rename `lint.yml` to `actions-lint.yml` to distinguish this repo's own workflow lint from the reusable `lints.yml` that consumers call.

Supersedes the open Dependabot PRs, several of which had themselves gone stale — lychee is now on 2.9.0 rather than the 2.2.0 in #85, and codecov on v7 rather than the v5 in #83. actions/checkout v4 -> v7 codecov/codecov-action v4 -> v7 EmbarkStudios/cargo-deny-action v1 -> v2 lycheeverse/lychee-action v2.0.2 -> v2.9.0 mikepenz/release-changelog-builder-action v5 -> v6 peter-evans/commit-comment v3 -> v4 peter-evans/create-issue-from-file v5 -> v6 peter-evans/create-or-update-comment v4 -> v5 peter-evans/create-pull-request v7 -> v8 stefanzweifel/git-auto-commit-action v5 -> v7 xt0rted/pull-request-comment-branch v2 -> v3 Most of these majors are Node 24 runtime moves, which need Actions Runner v2.327.1 or later on the self-hosted GPU runners. Every input still passed was checked against the new version's `action.yml`. Fix the link checker's failure path while bumping it: lychee stopped exporting `lychee_exit_code` to the environment in v2, so the condition guarding the issue-opening step has been reading an unset variable — and never firing — since the action moved to v2.0.2. Read the exit code from the step output instead.

samuelburnham · 2026-08-24T15:28:56Z

No description provided.

Add an `actionlint` + `zizmor` composite action and a `lint.yml` that runs it over this repo, with config for the org's self-hosted runner labels and for the zizmor rules that don't apply here. Fix what those linters found: - Move `github.event.*` interpolations into `env:` in `bench-pr-comment.yml` and `gpu-bench.yml` so untrusted input can't be injected into `run:`. - Migrate the deprecated `tibdex/github-app-token` to `actions/create-github-app-token` in `typos.yml`, and request explicit token permissions there and in `repo-sync.yml`. - Quote the `FILE_PATHS` assignment in `typos.yml`. - Drop `if $(...)` command substitution in `lints.yml`. - Remove the `type:` key from a composite action input, which Actions does not support. Remove the `benchmark-plotter` and `check-downstream-compiles` crates along with their only consumers, `bench-deploy.yml`, `ci.yml`, and the `check-downstream-compiles` action. Give Dependabot a 7-day cooldown before opening update PRs.

The new lint job surfaced ~200 findings in workflows and actions that predate it. Fix them rather than suppress them: - Move `inputs.*`, `env.*`, and `github.*` interpolations out of `run:` blocks and into `env:`, so untrusted values reach the shell as variables instead of being spliced into the script. Where a value is read back from `$GITHUB_ENV` it becomes a plain shell variable, and `github.sha`/`github.repository` use the runner's own `GITHUB_*` vars. - Set `persist-credentials: false` on checkouts that don't push. The primary checkout in `gpu-bench.yml` keeps its credentials, since `git-auto-commit-action` pushes with them; every other push path authenticates with an explicit token. - Annotate the remaining findings inline with a rationale: `GITHUB_ENV` writes that pass state between steps of a composite action, and `ncipollo/release-action`, whose `allowUpdates` behavior `gh release` does not provide. `continue-on-error` is silently ignored on composite action steps, so zizmor could never have been advisory as its input claimed. Drop the `zizmor-advisory` input and document that findings fail the caller. Rename `lint.yml` to `actions-lint.yml` to distinguish this repo's own workflow lint from the reusable `lints.yml` that consumers call.

Supersedes the open Dependabot PRs, several of which had themselves gone stale — lychee is now on 2.9.0 rather than the 2.2.0 in #85, and codecov on v7 rather than the v5 in #83. actions/checkout v4 -> v7 codecov/codecov-action v4 -> v7 EmbarkStudios/cargo-deny-action v1 -> v2 lycheeverse/lychee-action v2.0.2 -> v2.9.0 mikepenz/release-changelog-builder-action v5 -> v6 peter-evans/commit-comment v3 -> v4 peter-evans/create-issue-from-file v5 -> v6 peter-evans/create-or-update-comment v4 -> v5 peter-evans/create-pull-request v7 -> v8 stefanzweifel/git-auto-commit-action v5 -> v7 xt0rted/pull-request-comment-branch v2 -> v3 Most of these majors are Node 24 runtime moves, which need Actions Runner v2.327.1 or later on the self-hosted GPU runners. Every input still passed was checked against the new version's `action.yml`. Fix the link checker's failure path while bumping it: lychee stopped exporting `lychee_exit_code` to the environment in v2, so the condition guarding the issue-opening step has been reading an unset variable — and never firing — since the action moved to v2.0.2. Read the exit code from the step output instead.

samuelburnham · 2026-08-24T15:28:56Z

No description provided.

Add an `actionlint` + `zizmor` composite action and a `lint.yml` that runs it over this repo, with config for the org's self-hosted runner labels and for the zizmor rules that don't apply here. Fix what those linters found: - Move `github.event.*` interpolations into `env:` in `bench-pr-comment.yml` and `gpu-bench.yml` so untrusted input can't be injected into `run:`. - Migrate the deprecated `tibdex/github-app-token` to `actions/create-github-app-token` in `typos.yml`, and request explicit token permissions there and in `repo-sync.yml`. - Quote the `FILE_PATHS` assignment in `typos.yml`. - Drop `if $(...)` command substitution in `lints.yml`. - Remove the `type:` key from a composite action input, which Actions does not support. Remove the `benchmark-plotter` and `check-downstream-compiles` crates along with their only consumers, `bench-deploy.yml`, `ci.yml`, and the `check-downstream-compiles` action. Give Dependabot a 7-day cooldown before opening update PRs.

The new lint job surfaced ~200 findings in workflows and actions that predate it. Fix them rather than suppress them: - Move `inputs.*`, `env.*`, and `github.*` interpolations out of `run:` blocks and into `env:`, so untrusted values reach the shell as variables instead of being spliced into the script. Where a value is read back from `$GITHUB_ENV` it becomes a plain shell variable, and `github.sha`/`github.repository` use the runner's own `GITHUB_*` vars. - Set `persist-credentials: false` on checkouts that don't push. The primary checkout in `gpu-bench.yml` keeps its credentials, since `git-auto-commit-action` pushes with them; every other push path authenticates with an explicit token. - Annotate the remaining findings inline with a rationale: `GITHUB_ENV` writes that pass state between steps of a composite action, and `ncipollo/release-action`, whose `allowUpdates` behavior `gh release` does not provide. `continue-on-error` is silently ignored on composite action steps, so zizmor could never have been advisory as its input claimed. Drop the `zizmor-advisory` input and document that findings fail the caller. Rename `lint.yml` to `actions-lint.yml` to distinguish this repo's own workflow lint from the reusable `lints.yml` that consumers call.

Supersedes the open Dependabot PRs, several of which had themselves gone stale — lychee is now on 2.9.0 rather than the 2.2.0 in #85, and codecov on v7 rather than the v5 in #83. actions/checkout v4 -> v7 codecov/codecov-action v4 -> v7 EmbarkStudios/cargo-deny-action v1 -> v2 lycheeverse/lychee-action v2.0.2 -> v2.9.0 mikepenz/release-changelog-builder-action v5 -> v6 peter-evans/commit-comment v3 -> v4 peter-evans/create-issue-from-file v5 -> v6 peter-evans/create-or-update-comment v4 -> v5 peter-evans/create-pull-request v7 -> v8 stefanzweifel/git-auto-commit-action v5 -> v7 xt0rted/pull-request-comment-branch v2 -> v3 Most of these majors are Node 24 runtime moves, which need Actions Runner v2.327.1 or later on the self-hosted GPU runners. Every input still passed was checked against the new version's `action.yml`. Fix the link checker's failure path while bumping it: lychee stopped exporting `lychee_exit_code` to the environment in v2, so the condition guarding the issue-opening step has been reading an unset variable — and never firing — since the action moved to v2.0.2. Read the exit code from the step output instead.

samuelburnham · 2026-08-24T15:28:56Z

No description provided.

Add an `actionlint` + `zizmor` composite action and a `lint.yml` that runs it over this repo, with config for the org's self-hosted runner labels and for the zizmor rules that don't apply here. Fix what those linters found: - Move `github.event.*` interpolations into `env:` in `bench-pr-comment.yml` and `gpu-bench.yml` so untrusted input can't be injected into `run:`. - Migrate the deprecated `tibdex/github-app-token` to `actions/create-github-app-token` in `typos.yml`, and request explicit token permissions there and in `repo-sync.yml`. - Quote the `FILE_PATHS` assignment in `typos.yml`. - Drop `if $(...)` command substitution in `lints.yml`. - Remove the `type:` key from a composite action input, which Actions does not support. Remove the `benchmark-plotter` and `check-downstream-compiles` crates along with their only consumers, `bench-deploy.yml`, `ci.yml`, and the `check-downstream-compiles` action. Give Dependabot a 7-day cooldown before opening update PRs.

The new lint job surfaced ~200 findings in workflows and actions that predate it. Fix them rather than suppress them: - Move `inputs.*`, `env.*`, and `github.*` interpolations out of `run:` blocks and into `env:`, so untrusted values reach the shell as variables instead of being spliced into the script. Where a value is read back from `$GITHUB_ENV` it becomes a plain shell variable, and `github.sha`/`github.repository` use the runner's own `GITHUB_*` vars. - Set `persist-credentials: false` on checkouts that don't push. The primary checkout in `gpu-bench.yml` keeps its credentials, since `git-auto-commit-action` pushes with them; every other push path authenticates with an explicit token. - Annotate the remaining findings inline with a rationale: `GITHUB_ENV` writes that pass state between steps of a composite action, and `ncipollo/release-action`, whose `allowUpdates` behavior `gh release` does not provide. `continue-on-error` is silently ignored on composite action steps, so zizmor could never have been advisory as its input claimed. Drop the `zizmor-advisory` input and document that findings fail the caller. Rename `lint.yml` to `actions-lint.yml` to distinguish this repo's own workflow lint from the reusable `lints.yml` that consumers call.

Supersedes the open Dependabot PRs, several of which had themselves gone stale — lychee is now on 2.9.0 rather than the 2.2.0 in #85, and codecov on v7 rather than the v5 in #83. actions/checkout v4 -> v7 codecov/codecov-action v4 -> v7 EmbarkStudios/cargo-deny-action v1 -> v2 lycheeverse/lychee-action v2.0.2 -> v2.9.0 mikepenz/release-changelog-builder-action v5 -> v6 peter-evans/commit-comment v3 -> v4 peter-evans/create-issue-from-file v5 -> v6 peter-evans/create-or-update-comment v4 -> v5 peter-evans/create-pull-request v7 -> v8 stefanzweifel/git-auto-commit-action v5 -> v7 xt0rted/pull-request-comment-branch v2 -> v3 Most of these majors are Node 24 runtime moves, which need Actions Runner v2.327.1 or later on the self-hosted GPU runners. Every input still passed was checked against the new version's `action.yml`. Fix the link checker's failure path while bumping it: lychee stopped exporting `lychee_exit_code` to the environment in v2, so the condition guarding the issue-opening step has been reading an unset variable — and never firing — since the action moved to v2.0.2. Read the exit code from the step output instead.

samuelburnham · 2026-08-24T15:28:56Z

No description provided.

Add an `actionlint` + `zizmor` composite action and a `lint.yml` that runs it over this repo, with config for the org's self-hosted runner labels and for the zizmor rules that don't apply here. Fix what those linters found: - Move `github.event.*` interpolations into `env:` in `bench-pr-comment.yml` and `gpu-bench.yml` so untrusted input can't be injected into `run:`. - Migrate the deprecated `tibdex/github-app-token` to `actions/create-github-app-token` in `typos.yml`, and request explicit token permissions there and in `repo-sync.yml`. - Quote the `FILE_PATHS` assignment in `typos.yml`. - Drop `if $(...)` command substitution in `lints.yml`. - Remove the `type:` key from a composite action input, which Actions does not support. Remove the `benchmark-plotter` and `check-downstream-compiles` crates along with their only consumers, `bench-deploy.yml`, `ci.yml`, and the `check-downstream-compiles` action. Give Dependabot a 7-day cooldown before opening update PRs.

The new lint job surfaced ~200 findings in workflows and actions that predate it. Fix them rather than suppress them: - Move `inputs.*`, `env.*`, and `github.*` interpolations out of `run:` blocks and into `env:`, so untrusted values reach the shell as variables instead of being spliced into the script. Where a value is read back from `$GITHUB_ENV` it becomes a plain shell variable, and `github.sha`/`github.repository` use the runner's own `GITHUB_*` vars. - Set `persist-credentials: false` on checkouts that don't push. The primary checkout in `gpu-bench.yml` keeps its credentials, since `git-auto-commit-action` pushes with them; every other push path authenticates with an explicit token. - Annotate the remaining findings inline with a rationale: `GITHUB_ENV` writes that pass state between steps of a composite action, and `ncipollo/release-action`, whose `allowUpdates` behavior `gh release` does not provide. `continue-on-error` is silently ignored on composite action steps, so zizmor could never have been advisory as its input claimed. Drop the `zizmor-advisory` input and document that findings fail the caller. Rename `lint.yml` to `actions-lint.yml` to distinguish this repo's own workflow lint from the reusable `lints.yml` that consumers call.

Supersedes the open Dependabot PRs, several of which had themselves gone stale — lychee is now on 2.9.0 rather than the 2.2.0 in #85, and codecov on v7 rather than the v5 in #83. actions/checkout v4 -> v7 codecov/codecov-action v4 -> v7 EmbarkStudios/cargo-deny-action v1 -> v2 lycheeverse/lychee-action v2.0.2 -> v2.9.0 mikepenz/release-changelog-builder-action v5 -> v6 peter-evans/commit-comment v3 -> v4 peter-evans/create-issue-from-file v5 -> v6 peter-evans/create-or-update-comment v4 -> v5 peter-evans/create-pull-request v7 -> v8 stefanzweifel/git-auto-commit-action v5 -> v7 xt0rted/pull-request-comment-branch v2 -> v3 Most of these majors are Node 24 runtime moves, which need Actions Runner v2.327.1 or later on the self-hosted GPU runners. Every input still passed was checked against the new version's `action.yml`. Fix the link checker's failure path while bumping it: lychee stopped exporting `lychee_exit_code` to the environment in v2, so the condition guarding the issue-opening step has been reading an unset variable — and never firing — since the action moved to v2.0.2. Read the exit code from the step output instead.

samuelburnham · 2026-08-24T15:28:56Z

No description provided.

Add an `actionlint` + `zizmor` composite action and a `lint.yml` that runs it over this repo, with config for the org's self-hosted runner labels and for the zizmor rules that don't apply here. Fix what those linters found: - Move `github.event.*` interpolations into `env:` in `bench-pr-comment.yml` and `gpu-bench.yml` so untrusted input can't be injected into `run:`. - Migrate the deprecated `tibdex/github-app-token` to `actions/create-github-app-token` in `typos.yml`, and request explicit token permissions there and in `repo-sync.yml`. - Quote the `FILE_PATHS` assignment in `typos.yml`. - Drop `if $(...)` command substitution in `lints.yml`. - Remove the `type:` key from a composite action input, which Actions does not support. Remove the `benchmark-plotter` and `check-downstream-compiles` crates along with their only consumers, `bench-deploy.yml`, `ci.yml`, and the `check-downstream-compiles` action. Give Dependabot a 7-day cooldown before opening update PRs.

The new lint job surfaced ~200 findings in workflows and actions that predate it. Fix them rather than suppress them: - Move `inputs.*`, `env.*`, and `github.*` interpolations out of `run:` blocks and into `env:`, so untrusted values reach the shell as variables instead of being spliced into the script. Where a value is read back from `$GITHUB_ENV` it becomes a plain shell variable, and `github.sha`/`github.repository` use the runner's own `GITHUB_*` vars. - Set `persist-credentials: false` on checkouts that don't push. The primary checkout in `gpu-bench.yml` keeps its credentials, since `git-auto-commit-action` pushes with them; every other push path authenticates with an explicit token. - Annotate the remaining findings inline with a rationale: `GITHUB_ENV` writes that pass state between steps of a composite action, and `ncipollo/release-action`, whose `allowUpdates` behavior `gh release` does not provide. `continue-on-error` is silently ignored on composite action steps, so zizmor could never have been advisory as its input claimed. Drop the `zizmor-advisory` input and document that findings fail the caller. Rename `lint.yml` to `actions-lint.yml` to distinguish this repo's own workflow lint from the reusable `lints.yml` that consumers call.

Supersedes the open Dependabot PRs, several of which had themselves gone stale — lychee is now on 2.9.0 rather than the 2.2.0 in #85, and codecov on v7 rather than the v5 in #83. actions/checkout v4 -> v7 codecov/codecov-action v4 -> v7 EmbarkStudios/cargo-deny-action v1 -> v2 lycheeverse/lychee-action v2.0.2 -> v2.9.0 mikepenz/release-changelog-builder-action v5 -> v6 peter-evans/commit-comment v3 -> v4 peter-evans/create-issue-from-file v5 -> v6 peter-evans/create-or-update-comment v4 -> v5 peter-evans/create-pull-request v7 -> v8 stefanzweifel/git-auto-commit-action v5 -> v7 xt0rted/pull-request-comment-branch v2 -> v3 Most of these majors are Node 24 runtime moves, which need Actions Runner v2.327.1 or later on the self-hosted GPU runners. Every input still passed was checked against the new version's `action.yml`. Fix the link checker's failure path while bumping it: lychee stopped exporting `lychee_exit_code` to the environment in v2, so the condition guarding the issue-opening step has been reading an unset variable — and never firing — since the action moved to v2.0.2. Read the exit code from the step output instead.

samuelburnham · 2026-08-24T15:28:56Z

No description provided.

Add an `actionlint` + `zizmor` composite action and a `lint.yml` that runs it over this repo, with config for the org's self-hosted runner labels and for the zizmor rules that don't apply here. Fix what those linters found: - Move `github.event.*` interpolations into `env:` in `bench-pr-comment.yml` and `gpu-bench.yml` so untrusted input can't be injected into `run:`. - Migrate the deprecated `tibdex/github-app-token` to `actions/create-github-app-token` in `typos.yml`, and request explicit token permissions there and in `repo-sync.yml`. - Quote the `FILE_PATHS` assignment in `typos.yml`. - Drop `if $(...)` command substitution in `lints.yml`. - Remove the `type:` key from a composite action input, which Actions does not support. Remove the `benchmark-plotter` and `check-downstream-compiles` crates along with their only consumers, `bench-deploy.yml`, `ci.yml`, and the `check-downstream-compiles` action. Give Dependabot a 7-day cooldown before opening update PRs.

The new lint job surfaced ~200 findings in workflows and actions that predate it. Fix them rather than suppress them: - Move `inputs.*`, `env.*`, and `github.*` interpolations out of `run:` blocks and into `env:`, so untrusted values reach the shell as variables instead of being spliced into the script. Where a value is read back from `$GITHUB_ENV` it becomes a plain shell variable, and `github.sha`/`github.repository` use the runner's own `GITHUB_*` vars. - Set `persist-credentials: false` on checkouts that don't push. The primary checkout in `gpu-bench.yml` keeps its credentials, since `git-auto-commit-action` pushes with them; every other push path authenticates with an explicit token. - Annotate the remaining findings inline with a rationale: `GITHUB_ENV` writes that pass state between steps of a composite action, and `ncipollo/release-action`, whose `allowUpdates` behavior `gh release` does not provide. `continue-on-error` is silently ignored on composite action steps, so zizmor could never have been advisory as its input claimed. Drop the `zizmor-advisory` input and document that findings fail the caller. Rename `lint.yml` to `actions-lint.yml` to distinguish this repo's own workflow lint from the reusable `lints.yml` that consumers call.

Supersedes the open Dependabot PRs, several of which had themselves gone stale — lychee is now on 2.9.0 rather than the 2.2.0 in #85, and codecov on v7 rather than the v5 in #83. actions/checkout v4 -> v7 codecov/codecov-action v4 -> v7 EmbarkStudios/cargo-deny-action v1 -> v2 lycheeverse/lychee-action v2.0.2 -> v2.9.0 mikepenz/release-changelog-builder-action v5 -> v6 peter-evans/commit-comment v3 -> v4 peter-evans/create-issue-from-file v5 -> v6 peter-evans/create-or-update-comment v4 -> v5 peter-evans/create-pull-request v7 -> v8 stefanzweifel/git-auto-commit-action v5 -> v7 xt0rted/pull-request-comment-branch v2 -> v3 Most of these majors are Node 24 runtime moves, which need Actions Runner v2.327.1 or later on the self-hosted GPU runners. Every input still passed was checked against the new version's `action.yml`. Fix the link checker's failure path while bumping it: lychee stopped exporting `lychee_exit_code` to the environment in v2, so the condition guarding the issue-opening step has been reading an unset variable — and never firing — since the action moved to v2.0.2. Read the exit code from the step output instead.

samuelburnham · 2026-08-24T15:28:56Z

No description provided.

Add an `actionlint` + `zizmor` composite action and a `lint.yml` that runs it over this repo, with config for the org's self-hosted runner labels and for the zizmor rules that don't apply here. Fix what those linters found: - Move `github.event.*` interpolations into `env:` in `bench-pr-comment.yml` and `gpu-bench.yml` so untrusted input can't be injected into `run:`. - Migrate the deprecated `tibdex/github-app-token` to `actions/create-github-app-token` in `typos.yml`, and request explicit token permissions there and in `repo-sync.yml`. - Quote the `FILE_PATHS` assignment in `typos.yml`. - Drop `if $(...)` command substitution in `lints.yml`. - Remove the `type:` key from a composite action input, which Actions does not support. Remove the `benchmark-plotter` and `check-downstream-compiles` crates along with their only consumers, `bench-deploy.yml`, `ci.yml`, and the `check-downstream-compiles` action. Give Dependabot a 7-day cooldown before opening update PRs.

The new lint job surfaced ~200 findings in workflows and actions that predate it. Fix them rather than suppress them: - Move `inputs.*`, `env.*`, and `github.*` interpolations out of `run:` blocks and into `env:`, so untrusted values reach the shell as variables instead of being spliced into the script. Where a value is read back from `$GITHUB_ENV` it becomes a plain shell variable, and `github.sha`/`github.repository` use the runner's own `GITHUB_*` vars. - Set `persist-credentials: false` on checkouts that don't push. The primary checkout in `gpu-bench.yml` keeps its credentials, since `git-auto-commit-action` pushes with them; every other push path authenticates with an explicit token. - Annotate the remaining findings inline with a rationale: `GITHUB_ENV` writes that pass state between steps of a composite action, and `ncipollo/release-action`, whose `allowUpdates` behavior `gh release` does not provide. `continue-on-error` is silently ignored on composite action steps, so zizmor could never have been advisory as its input claimed. Drop the `zizmor-advisory` input and document that findings fail the caller. Rename `lint.yml` to `actions-lint.yml` to distinguish this repo's own workflow lint from the reusable `lints.yml` that consumers call.

Supersedes the open Dependabot PRs, several of which had themselves gone stale — lychee is now on 2.9.0 rather than the 2.2.0 in #85, and codecov on v7 rather than the v5 in #83. actions/checkout v4 -> v7 codecov/codecov-action v4 -> v7 EmbarkStudios/cargo-deny-action v1 -> v2 lycheeverse/lychee-action v2.0.2 -> v2.9.0 mikepenz/release-changelog-builder-action v5 -> v6 peter-evans/commit-comment v3 -> v4 peter-evans/create-issue-from-file v5 -> v6 peter-evans/create-or-update-comment v4 -> v5 peter-evans/create-pull-request v7 -> v8 stefanzweifel/git-auto-commit-action v5 -> v7 xt0rted/pull-request-comment-branch v2 -> v3 Most of these majors are Node 24 runtime moves, which need Actions Runner v2.327.1 or later on the self-hosted GPU runners. Every input still passed was checked against the new version's `action.yml`. Fix the link checker's failure path while bumping it: lychee stopped exporting `lychee_exit_code` to the environment in v2, so the condition guarding the issue-opening step has been reading an unset variable — and never firing — since the action moved to v2.0.2. Read the exit code from the step output instead.

samuelburnham added 3 commits August 15, 2026 08:45

ci: Update repo-sync workflow
fa74941