style: add zizmor config

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
     directory: /
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       actions:
         patterns:
@@ -17,6 +19,8 @@ updates:
     directory: /
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       uv-pip:
         patterns:
@@ -25,6 +29,8 @@ updates:
     directory: /
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     ignore:
       - dependency-name: cpp-linter
     groups:
@@ -35,6 +41,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       npm:
         patterns:

.github/install-clang-action/action.yml

@@ -12,17 +12,19 @@ runs:
     - name: Install Linux clang dependencies
       if: runner.os == 'Linux'
       shell: bash
+      env:
+        CLANG_VERSION: ${{ inputs.version }}
       # NOTE: sudo apt-get update should be executed at least once before running this action
       run: |
         # First try installing from default Ubuntu repositories before trying LLVM script
-        if ! sudo apt-get install -y clang-format-${{ inputs.version }} clang-tidy-${{ inputs.version }}; then
+        if ! sudo apt-get install -y clang-format-${CLANG_VERSION} clang-tidy-${CLANG_VERSION}; then
           if [ ! -f "${{ runner.temp }}/llvm_install.sh" ]; then
             # This LLVM script will add the relevant LLVM PPA: https://apt.llvm.org/
             wget https://apt.llvm.org/llvm.sh -O ${{ runner.temp }}/llvm_install.sh
             chmod +x ${{ runner.temp }}/llvm_install.sh
           fi
-          if sudo "${{ runner.temp }}/llvm_install.sh" "${{ inputs.version }}" ; then
-            sudo apt-get install -y clang-format-${{ inputs.version }} clang-tidy-${{ inputs.version }}
+          if sudo "${{ runner.temp }}/llvm_install.sh" "${CLANG_VERSION}" ; then
+            sudo apt-get install -y clang-format-${CLANG_VERSION} clang-tidy-${CLANG_VERSION}
           fi
           # remove the PPA for future reuse of install script (regardless of successful install)
           sudo rm /etc/apt/sources.list.d/*llvm*.list || true
@@ -32,14 +34,17 @@ runs:
       if: runner.os == 'macOS'
       shell: bash
       continue-on-error: true
+      env:
+        CLANG_VERSION: ${{ inputs.version }}
       run: |
         brew update
-        brew install llvm@${{ inputs.version }}
-        ln -s "$(brew --prefix llvm@${{ inputs.version }})/bin/clang-format" "/usr/local/bin/clang-format-${{ inputs.version }}"
-        ln -s "$(brew --prefix llvm@${{ inputs.version }})/bin/clang-tidy" "/usr/local/bin/clang-tidy-${{ inputs.version }}"
-
+        brew install llvm@${CLANG_VERSION}
+        ln -s "$(brew --prefix llvm@${CLANG_VERSION})/bin/clang-format" "/usr/local/bin/clang-format-${CLANG_VERSION}"
+        ln -s "$(brew --prefix llvm@${CLANG_VERSION})/bin/clang-tidy" "/usr/local/bin/clang-tidy-${CLANG_VERSION}"
     - name: Use clang-tools-pip as fallback
       shell: bash
+      env:
+        CLANG_VERSION: ${{ inputs.version }}
       run: |
         python -m pip install clang-tools
-        clang-tools -i ${{ inputs.version }} -b -f
+        clang-tools -i ${CLANG_VERSION} -b -f

.github/zizmor.yml

@@ -0,0 +1,8 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        github/*: ref-pin
+        dependabot/*: ref-pin
+        cpp-linter/*: any

cspell.config.yml

@@ -15,6 +15,7 @@ words:
   - codecov
   - codspeed
   - consts
+  - cooldown
   - cppcoreguidelines
   - cstdio
   - cstdlib