From 2b3c871b08564f03ec964980110deb750b313244 Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Thu, 13 Aug 2026 01:54:33 +0000
Subject: [PATCH 01/10] Fix Zizmor warnings and update GitHub Actions versions

---
 .github/workflows/ci.yaml                | 90 +++++++++++++-----------
 .github/workflows/cirq_compatibility.yml |  9 ++-
 .github/workflows/pr-labeler.yaml        |  8 +--
 .github/workflows/pr-text-checker.yaml   |  3 +-
 .github/workflows/scorecard-scanner.yaml | 38 ++++++----
 5 files changed, 85 insertions(+), 63 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 011561bd7..5e63051c5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,26 +34,20 @@ on:
 
   workflow_dispatch:
     inputs:
-      debug:
-        description: 'Run with debugging options'
-        type: boolean
-        default: true
       soft-linting:
         description: 'Do not quit for linting errors'
         type: boolean
         default: true
 
 env:
-  # Python version to use for actions/setup-python.
-  python-version: '3.13'
-  SHELLOPTS: ${{inputs.debug && 'xtrace'}}
   PIP_PROGRESS_BAR: 'off'
 
 concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   python-checks:
@@ -62,14 +56,15 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: ${{env.python-version}}
+          python-version: 3.13
           cache: pip
           cache-dependency-path: |
             requirements.txt
@@ -101,7 +96,9 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run hadolint on Dockerfiles
         continue-on-error: ${{inputs.soft-linting == 'true'}}
@@ -123,7 +120,9 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install problem matcher
         run: echo '::add-matcher::.github/problem-matchers/shellcheck.json'
@@ -144,7 +143,9 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install yamllint
         run: |
@@ -164,7 +165,9 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Buildifier
         uses: jbajic/setup-buildifier@c558ee05c6f74ab5753ff794516750b4aadac296 # v1
@@ -184,13 +187,15 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run actionlint
         continue-on-error: ${{inputs.soft-linting == 'true'}}
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
         with:
-          flags: ${{inputs.debug && '-verbose'}}
+          flags: ${{runner.debug == '1' && '-verbose' || '' }}
           files: '.github/workflows/*.{yaml,yml}'
           pyflakes: false
 
@@ -221,12 +226,13 @@ jobs:
           - '3.13'
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           submodules: recursive
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         id: setup
         with:
           python-version: ${{matrix.python_version}}
@@ -244,13 +250,13 @@ jobs:
       - name: Set up Bazel
         uses: './.github/actions/set-up-bazel'
         with:
-          debug: ${{inputs.debug}}
+          debug: ${{runner.debug == '1'}}
 
       - if: ${{! startsWith(matrix.os, 'windows-')}}
         name: Build the qsim C++ library and run tests (non-Windows case)
         run: |
           alias bazel=bazelisk
-          dev_tools/test_libs.sh ${{inputs.debug && '--config=verbose'}}
+          dev_tools/test_libs.sh ${{inputs.debug == '1' && '--config=verbose'}}
 
       - if: ${{startsWith(matrix.os, 'windows-')}}
         name: Build the qsim C++ library and run tests (Windows case)
@@ -260,8 +266,9 @@ jobs:
         env:
           root: 'C:\\hostedtoolcache\\windows\\Python'
           exe: '${{steps.setup.outputs.python-version}}\\x64\\python3.exe'
-        shell: cmd
-        run: bash -x dev_tools/test_libs.sh ${{inputs.debug && '--config=verbose'}} --action_env PYTHON_BIN_PATH=${{env.root}}\\${{env.exe}}
+        shell: pwsh
+        # zizmor: ignore[template-injection]
+        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose'}} --action_env PYTHON_BIN_PATH=${{env.root}}\\${{env.exe}}
 
       - name: Install LLVM and OpenMP on macOS
         if: startsWith(matrix.os, 'macos')
@@ -291,8 +298,8 @@ jobs:
         run: |
           mkdir -p build
           cd build
-          cmake ${{inputs.debug && '--debug-output' || ''}} ..
-          cmake --build . -j ${{inputs.debug && '--verbose' || ''}}
+          cmake ${{runner.debug == '1' && '--debug-output' || ''}} ..
+          cmake --build . -j ${{runner.debug == '1' && '--verbose' || ''}}
 
   options-tests:
     name: Options tests
@@ -313,14 +320,15 @@ jobs:
         parallel_opt: [openmp, nopenmp]
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           submodules: recursive
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: ${{env.python-version}}
+          python-version: 3.13
           cache: pip
           cache-dependency-path: |
             requirements.txt
@@ -335,14 +343,14 @@ jobs:
       - name: Set up Bazel
         uses: './.github/actions/set-up-bazel'
         with:
-          debug: ${{inputs.debug}}
+          debug: ${{runner.debug == '1'}}
 
       - name: Run C++ tests
         run: |
           bazel test \
               --config=${{matrix.hardware_opt}} \
               --config=${{matrix.parallel_opt}} \
-              ${{inputs.debug && '--config=verbose'}} \
+              ${{inputs.debug == '1' && '--config=verbose'}} \
               tests:all
 
       - name: Run sample simulation
@@ -350,7 +358,7 @@ jobs:
           bazel run \
               --config=${{matrix.hardware_opt}} \
               --config=${{matrix.parallel_opt}} \
-              ${{inputs.debug && '--config=verbose'}} \
+              ${{inputs.debug == '1' && '--config=verbose'}} \
               apps:qsim_base -- -c circuits/circuit_q24
 
   memory-tests:
@@ -368,18 +376,19 @@ jobs:
       common_args: >-
         --config=avx
         --config=openmp
-        ${{inputs.debug && '--config=verbose'}}
+        --config=verbose
         tests:all
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           submodules: recursive
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: ${{env.python-version}}
+          python-version: 3.13
           cache: pip
           cache-dependency-path: |
             requirements.txt
@@ -394,7 +403,7 @@ jobs:
       - name: Set up Bazel
         uses: './.github/actions/set-up-bazel'
         with:
-          debug: ${{inputs.debug}}
+          debug: ${{runner.debug == '1'}}
 
       - name: Install google-perftools for tcmalloc
         run: |
@@ -403,7 +412,7 @@ jobs:
 
       - name: Run TCMalloc tests
         env:
-          PERFTOOLS_VERBOSE: ${{inputs.debug && 1}}
+          PERFTOOLS_VERBOSE: ${{runner.debug == '1' && 1 || ''}}
         run: bazel test --config=tcmalloc ${{env.common_args}}
 
       - name: Run memory sanitizer tests
@@ -425,11 +434,12 @@ jobs:
     timeout-minutes: 60
     env:
       # The next environment variable is used by Docker.
-      BUILDKIT_PROGRESS: ${{inputs.debug && 'plain'}}
+      BUILDKIT_PROGRESS: ${{runner.debug == '1' && 'plain'}}
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           submodules: recursive
 
       - name: Build Docker images
diff --git a/.github/workflows/cirq_compatibility.yml b/.github/workflows/cirq_compatibility.yml
index 986aefbd2..db6f44015 100644
--- a/.github/workflows/cirq_compatibility.yml
+++ b/.github/workflows/cirq_compatibility.yml
@@ -26,7 +26,8 @@ on:
         type: boolean
         default: true
 
-permissions: read-all
+permissions:
+  contents: read
 
 concurrency:
   # Cancel any previously-started but still active runs on the same branch.
@@ -41,13 +42,15 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 1
           submodules: recursive
 
       - name: Set up Python with caching of pip dependencies
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5
+        # yamllint disable rule:line-length
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
           cache: pip
diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
index 0f69dff11..7252d094c 100644
--- a/.github/workflows/pr-labeler.yaml
+++ b/.github/workflows/pr-labeler.yaml
@@ -24,12 +24,12 @@ on:
   # Note: do not copy-paste this workflow with `pull_request_target` left as-is.
   # Its use here is a special case where security implications are understood.
   # Workflows should normally use `pull_request` instead.
+  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types:
       - opened
       - synchronize
 
-  # Allow manual invocation.
   workflow_dispatch:
     inputs:
       pr-number:
@@ -41,8 +41,7 @@ on:
         type: boolean
         default: true
 
-# Declare default workflow permissions as read only.
-permissions: read-all
+permissions: {}
 
 jobs:
   label-pr-size:
@@ -61,8 +60,9 @@ jobs:
       SHELLOPTS: ${{inputs.debug && 'xtrace' || '' }}
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           sparse-checkout: |
             ./dev_tools/ci/size-labeler.sh
 
diff --git a/.github/workflows/pr-text-checker.yaml b/.github/workflows/pr-text-checker.yaml
index ededc464a..9caf86dce 100644
--- a/.github/workflows/pr-text-checker.yaml
+++ b/.github/workflows/pr-text-checker.yaml
@@ -31,7 +31,8 @@ on:
     branches:
       - main
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   check-text-length:
diff --git a/.github/workflows/scorecard-scanner.yaml b/.github/workflows/scorecard-scanner.yaml
index 5a9eee6f3..7b8e2d796 100644
--- a/.github/workflows/scorecard-scanner.yaml
+++ b/.github/workflows/scorecard-scanner.yaml
@@ -1,4 +1,4 @@
-# Copyright 2025 Google LLC
+# Copyright 2026 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 name: Scorecard analysis
-run-name: Run Scorecard scanner for security best practices
+run-name: Run Scorecard analyzer
 
 # Scorecard (https://github.com/ossf/scorecard) is a repository-scanning tool
 # that evaluates a project's security practices. Its use is suggested by
@@ -26,54 +26,62 @@ on:
     - cron:  '30 9 * * 6'
 
   pull_request:
-    types: [opened, synchronize]
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
     branches:
       - main
 
-  # Allow manual invocation.
   workflow_dispatch:
 
 concurrency:
-  # Cancel any previously-started but still active runs on the same branch.
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
-# Declare default workflow permissions as read only.
-permissions: read-all
+permissions: {}
 
 jobs:
   run-scorecard:
-    if: github.repository_owner == 'quantumlib'
+    # Skip fork PRs to avoid "Analysis configuration not found" errors.
+    if: >-
+      github.repository_owner == 'quantumlib' &&
+      (github.event_name != 'pull_request' ||
+       github.event.pull_request.head.repo.fork == false)
     name: Scorecard analyzer
     runs-on: ubuntu-24.04
     permissions:
       security-events: write
       id-token: write
+      contents: read
+      actions: read
+      issues: read
+      pull-requests: read
+      checks: read
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run Scorecard analysis
         # yamllint disable rule:line-length
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
-          # Save the results
           results_file: scorecard-results.sarif
           results_format: sarif
-          # See https://github.com/ossf/scorecard-action#publishing-results.
           publish_results: true
 
       - name: Upload results to code-scanning dashboard
         # yamllint disable rule:line-length
-        uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: scorecard-results.sarif
 
-  # Scorecard currently (ver. 2.4.x) doesn't allow submissions from jobs having
-  # steps that use "run:". To print to the summary, we need to use another job.
+  # Scorecard doesn't allow submissions from jobs having steps that use "run:".
+  # Printing a summary needs to use "run:", so we have to use a separate job.
   write-summary:
     name: Scorecard results
     needs: run-scorecard

From 0208cb36a6f65fbb85dea63fe8e6f01750e1a314 Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Thu, 13 Aug 2026 02:19:08 +0000
Subject: [PATCH 02/10] More fixes

---
 .github/workflows/ci.yaml                | 13 +++++++------
 .github/workflows/cirq_compatibility.yml |  7 +------
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 5e63051c5..d1f1c7583 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -256,7 +256,7 @@ jobs:
         name: Build the qsim C++ library and run tests (non-Windows case)
         run: |
           alias bazel=bazelisk
-          dev_tools/test_libs.sh ${{inputs.debug == '1' && '--config=verbose'}}
+          dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose'}}
 
       - if: ${{startsWith(matrix.os, 'windows-')}}
         name: Build the qsim C++ library and run tests (Windows case)
@@ -350,7 +350,7 @@ jobs:
           bazel test \
               --config=${{matrix.hardware_opt}} \
               --config=${{matrix.parallel_opt}} \
-              ${{inputs.debug == '1' && '--config=verbose'}} \
+              ${{runner.debug == '1' && '--config=verbose'}} \
               tests:all
 
       - name: Run sample simulation
@@ -358,7 +358,7 @@ jobs:
           bazel run \
               --config=${{matrix.hardware_opt}} \
               --config=${{matrix.parallel_opt}} \
-              ${{inputs.debug == '1' && '--config=verbose'}} \
+              ${{runner.debug == '1' && '--config=verbose'}} \
               apps:qsim_base -- -c circuits/circuit_q24
 
   memory-tests:
@@ -432,9 +432,6 @@ jobs:
       - yaml-lint
     runs-on: ubuntu-24.04-x64-16-core
     timeout-minutes: 60
-    env:
-      # The next environment variable is used by Docker.
-      BUILDKIT_PROGRESS: ${{runner.debug == '1' && 'plain'}}
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -442,6 +439,10 @@ jobs:
           persist-credentials: false
           submodules: recursive
 
+      - name: Configure Docker BuildKit for debug mode
+        if: runner.debug == '1'
+        run: echo "BUILDKIT_PROGRESS=plain" >> "$GITHUB_ENV"
+
       - name: Build Docker images
         run: |
           # Running locally, a plain "docker compose build" works as expected.
diff --git a/.github/workflows/cirq_compatibility.yml b/.github/workflows/cirq_compatibility.yml
index db6f44015..b5e4cf017 100644
--- a/.github/workflows/cirq_compatibility.yml
+++ b/.github/workflows/cirq_compatibility.yml
@@ -20,11 +20,6 @@ on:
     - cron: "10 7 * * *"
 
   workflow_dispatch:
-    inputs:
-      debug:
-        description: 'Run with debugging options'
-        type: boolean
-        default: true
 
 permissions:
   contents: read
@@ -66,5 +61,5 @@ jobs:
 
       - name: Run Python tests
         env:
-          PYTEST_ADDOPTS: ${{inputs.debug && '-n auto -v' || '-n auto' }}
+          PYTEST_ADDOPTS: ${{runner.debug && '-n auto -v' || '-n auto' }}
         run: make -j run-py-tests

From ed3580a1a138a553e23f77c34a3919c010208ac2 Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Thu, 13 Aug 2026 02:28:54 +0000
Subject: [PATCH 03/10] Try to solve another Zizmor error

---
 .github/workflows/ci.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d1f1c7583..3c8f702fa 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -267,8 +267,7 @@ jobs:
           root: 'C:\\hostedtoolcache\\windows\\Python'
           exe: '${{steps.setup.outputs.python-version}}\\x64\\python3.exe'
         shell: pwsh
-        # zizmor: ignore[template-injection]
-        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose'}} --action_env PYTHON_BIN_PATH=${{env.root}}\\${{env.exe}}
+        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose'}} --action_env PYTHON_BIN_PATH="${root}\\${exe}"
 
       - name: Install LLVM and OpenMP on macOS
         if: startsWith(matrix.os, 'macos')

From 30a4e4e8dce4914283c46ce6c499440643894ea6 Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Thu, 13 Aug 2026 02:48:30 +0000
Subject: [PATCH 04/10] Fix typo

---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3c8f702fa..9f5b4ffed 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -267,7 +267,7 @@ jobs:
           root: 'C:\\hostedtoolcache\\windows\\Python'
           exe: '${{steps.setup.outputs.python-version}}\\x64\\python3.exe'
         shell: pwsh
-        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose'}} --action_env PYTHON_BIN_PATH="${root}\\${exe}"
+        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose'}} --action_env PYTHON_BIN_PATH="${root}/${exe}"
 
       - name: Install LLVM and OpenMP on macOS
         if: startsWith(matrix.os, 'macos')

From 15cfc8b0d3c9695587f3f3e622b7f82854b3e3dc Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Thu, 13 Aug 2026 02:49:00 +0000
Subject: [PATCH 05/10] Add missing permissions to write-summary job

---
 .github/workflows/scorecard-scanner.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/scorecard-scanner.yaml b/.github/workflows/scorecard-scanner.yaml
index 7b8e2d796..37888c927 100644
--- a/.github/workflows/scorecard-scanner.yaml
+++ b/.github/workflows/scorecard-scanner.yaml
@@ -87,6 +87,8 @@ jobs:
     needs: run-scorecard
     runs-on: ubuntu-slim
     timeout-minutes: 5
+    permissions:
+      actions: read
     steps:
       - name: Write the Scorecard report page link to the workflow summary
         run: |

From 872b65326d0b68bc894b3179257515c2c9a312e3 Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Thu, 13 Aug 2026 02:57:45 +0000
Subject: [PATCH 06/10] Fix syntax gaffes

---
 .github/workflows/ci.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9f5b4ffed..8976cd400 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -256,7 +256,7 @@ jobs:
         name: Build the qsim C++ library and run tests (non-Windows case)
         run: |
           alias bazel=bazelisk
-          dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose'}}
+          dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}}
 
       - if: ${{startsWith(matrix.os, 'windows-')}}
         name: Build the qsim C++ library and run tests (Windows case)
@@ -267,7 +267,7 @@ jobs:
           root: 'C:\\hostedtoolcache\\windows\\Python'
           exe: '${{steps.setup.outputs.python-version}}\\x64\\python3.exe'
         shell: pwsh
-        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose'}} --action_env PYTHON_BIN_PATH="${root}/${exe}"
+        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="${root}/${exe}"
 
       - name: Install LLVM and OpenMP on macOS
         if: startsWith(matrix.os, 'macos')
@@ -349,7 +349,7 @@ jobs:
           bazel test \
               --config=${{matrix.hardware_opt}} \
               --config=${{matrix.parallel_opt}} \
-              ${{runner.debug == '1' && '--config=verbose'}} \
+              ${{runner.debug == '1' && '--config=verbose' || ''}} \
               tests:all
 
       - name: Run sample simulation
@@ -357,7 +357,7 @@ jobs:
           bazel run \
               --config=${{matrix.hardware_opt}} \
               --config=${{matrix.parallel_opt}} \
-              ${{runner.debug == '1' && '--config=verbose'}} \
+              ${{runner.debug == '1' && '--config=verbose' || ''}} \
               apps:qsim_base -- -c circuits/circuit_q24
 
   memory-tests:

From 3b544495a765403244e2f73d87bf52c570c60723 Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Fri, 14 Aug 2026 17:40:13 +0000
Subject: [PATCH 07/10] Go back to using GitHub variables

---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 8976cd400..c60507869 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -267,7 +267,7 @@ jobs:
           root: 'C:\\hostedtoolcache\\windows\\Python'
           exe: '${{steps.setup.outputs.python-version}}\\x64\\python3.exe'
         shell: pwsh
-        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="${root}/${exe}"
+        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="${{env.root}}\\${{env.exe}}"
 
       - name: Install LLVM and OpenMP on macOS
         if: startsWith(matrix.os, 'macos')

From bb50d1ad513054ffb56c8e4f72aa18ed98a84a47 Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Fri, 14 Aug 2026 17:43:07 +0000
Subject: [PATCH 08/10] Try another way to satisfy zizmor

---
 .github/workflows/ci.yaml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c60507869..6248c6f95 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -263,11 +263,8 @@ jobs:
         # On GitHub Windows runners, Bazel ends up finding a different "python3"
         # binary than what's installed by setup-python unless we tell Bazel what
         # to use. Here we do that by setting PYTHON_BIN_PATH.
-        env:
-          root: 'C:\\hostedtoolcache\\windows\\Python'
-          exe: '${{steps.setup.outputs.python-version}}\\x64\\python3.exe'
+        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="C:\\hostedtoolcache\\windows\\Python\\${{steps.setup.outputs.python-version}}\\x64\\python3.exe"
         shell: pwsh
-        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="${{env.root}}\\${{env.exe}}"
 
       - name: Install LLVM and OpenMP on macOS
         if: startsWith(matrix.os, 'macos')

From 9c8e654133cfb9c11759c70aeeae4afbc3a25c9a Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Fri, 14 Aug 2026 18:11:40 +0000
Subject: [PATCH 09/10] Try another approach

---
 .github/workflows/ci.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6248c6f95..b23abf34f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -263,7 +263,9 @@ jobs:
         # On GitHub Windows runners, Bazel ends up finding a different "python3"
         # binary than what's installed by setup-python unless we tell Bazel what
         # to use. Here we do that by setting PYTHON_BIN_PATH.
-        run: bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="C:\\hostedtoolcache\\windows\\Python\\${{steps.setup.outputs.python-version}}\\x64\\python3.exe"
+        run:
+          $pythonPath = (Get-Command python).Source -replace '\\', '/'
+          bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="$pythonPath"
         shell: pwsh
 
       - name: Install LLVM and OpenMP on macOS

From 5dbb6b0a4662c63b45634c785e39c773514e6403 Mon Sep 17 00:00:00 2001
From: mhucka <mhucka@google.com>
Date: Fri, 14 Aug 2026 18:17:06 +0000
Subject: [PATCH 10/10] Fix syntax

---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b23abf34f..7cadc24be 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -263,7 +263,7 @@ jobs:
         # On GitHub Windows runners, Bazel ends up finding a different "python3"
         # binary than what's installed by setup-python unless we tell Bazel what
         # to use. Here we do that by setting PYTHON_BIN_PATH.
-        run:
+        run: |
           $pythonPath = (Get-Command python).Source -replace '\\', '/'
           bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="$pythonPath"
         shell: pwsh