.github/: run zizmor --fix=all (#3326)

This change skips ci-windows-installed.yml as more investigation
is needed into environment related failures after the update.

.github/actions/setup-linux/action.yml

diff --git a/.github/actions/setup-linux/action.yml b/.github/actions/setup-linux/action.yml
index 241ea9b..25a4592 100644
--- a/.github/actions/setup-linux/action.yml
+++ b/.github/actions/setup-linux/action.yml
@@ -52,53 +52,53 @@
       shell: bash
     - name: Set up meson
       if: ${{ inputs.codec-dav1d == 'LOCAL' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} meson" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} meson" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libdav1d library
       if: ${{ inputs.codec-dav1d == 'SYSTEM' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} libdav1d-dev" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} libdav1d-dev" >> "$GITHUB_ENV"
       shell: bash
     - name: Install rav1e library
       if: ${{ inputs.codec-rav1e == 'SYSTEM' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} librav1e-dev" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} librav1e-dev" >> "$GITHUB_ENV"
       shell: bash
     - name: Install SVT-AV1 library
       if: ${{ inputs.codec-svt == 'SYSTEM' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} libsvtav1enc-dev" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} libsvtav1enc-dev" >> "$GITHUB_ENV"
       shell: bash
     - name: Set up tests
       if: ${{ inputs.gtest != 'OFF' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} imagemagick" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} imagemagick" >> "$GITHUB_ENV"
       shell: bash
     - name: Set up gtest
       if: ${{ inputs.gtest == 'SYSTEM' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} libgtest-dev" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} libgtest-dev" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libjpeg-turbo library
       if: ${{ inputs.libjpeg-turbo == 'SYSTEM' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} libjpeg-turbo8-dev" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} libjpeg-turbo8-dev" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libxml2 library
       if: ${{ inputs.libxml2 == 'SYSTEM' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} libxml2" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} libxml2" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libyuv library
       if: ${{ inputs.libyuv == 'SYSTEM' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} libyuv-dev" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} libyuv-dev" >> "$GITHUB_ENV"
       shell: bash
     - name: Install nasm
       if: ${{ inputs.codec-aom == 'LOCAL' || inputs.codec-avm == 'LOCAL' || inputs.codec-dav1d == 'LOCAL' || inputs.codec-svt == 'LOCAL' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} nasm" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} nasm" >> "$GITHUB_ENV"
       shell: bash
     - name: Install zlibpng library
       if: ${{ inputs.zlibpng == 'SYSTEM' }}
-      run: echo "AVIF_UNIX_LIBRARIES=${{ env.AVIF_UNIX_LIBRARIES }} libpng-dev" >> "$GITHUB_ENV"
+      run: echo "AVIF_UNIX_LIBRARIES=${AVIF_UNIX_LIBRARIES} libpng-dev" >> "$GITHUB_ENV"
       shell: bash
 
     - name: Install libraries
       run: |
         sudo apt update -y
-        sudo apt install -y ${{ env.AVIF_UNIX_LIBRARIES }}
+        sudo apt install -y ${AVIF_UNIX_LIBRARIES}
       shell: bash
 
     - uses: ./.github/actions/cache
@@ -117,5 +117,7 @@
 
     - name: Set GCC & G++ compiler
       if: ${{ inputs.gcc-version != '' }}
-      run: echo "CC=gcc-${{ inputs.gcc-version }}" >> $GITHUB_ENV && echo "CXX=g++-${{ inputs.gcc-version }}" >> $GITHUB_ENV
+      run: echo "CC=gcc-${INPUTS_GCC_VERSION}" >> $GITHUB_ENV && echo "CXX=g++-${INPUTS_GCC_VERSION}" >> $GITHUB_ENV
       shell: bash
+      env:
+        INPUTS_GCC_VERSION: ${{ inputs.gcc-version }}

.github/actions/setup-macos/action.yml

diff --git a/.github/actions/setup-macos/action.yml b/.github/actions/setup-macos/action.yml
index 617536c..d4ebc64 100644
--- a/.github/actions/setup-macos/action.yml
+++ b/.github/actions/setup-macos/action.yml
@@ -43,45 +43,45 @@
       shell: bash
     - name: Install dav1d library
       if: ${{ inputs.codec-dav1d == 'SYSTEM' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} dav1d" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} dav1d" >> "$GITHUB_ENV"
       shell: bash
     - name: Install rav1e library
       if: ${{ inputs.codec-rav1e == 'SYSTEM' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} rav1e" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} rav1e" >> "$GITHUB_ENV"
       shell: bash
     - name: Install SVT-AV1 library
       if: ${{ inputs.codec-svt == 'SYSTEM' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} svt-av1" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} svt-av1" >> "$GITHUB_ENV"
       shell: bash
     - name: Install meson
       if: ${{ inputs.codec-dav1d == 'LOCAL' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} meson" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} meson" >> "$GITHUB_ENV"
       shell: bash
     - name: Install imagemagick
       # imagemagick is used in sh tests (not gtest tests) but we assume that no tests are run by the CI
       # if gtest is off
       if: ${{ inputs.gtest != 'OFF' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} imagemagick" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} imagemagick" >> "$GITHUB_ENV"
       shell: bash
     - name: Install gtest
       if: ${{ inputs.gtest == 'SYSTEM' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} googletest" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} googletest" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libjpeg-turbo
       if: ${{ inputs.libjpeg-turbo == 'SYSTEM' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} libjpeg-turbo" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} libjpeg-turbo" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libxml2
       if: ${{ inputs.libxml2 == 'SYSTEM' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} libxml2" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} libxml2" >> "$GITHUB_ENV"
       shell: bash
     - name: Install nasm
       if: ${{ inputs.codec-aom == 'LOCAL' || inputs.codec-avm == 'LOCAL' || inputs.codec-dav1d == 'LOCAL' || inputs.codec-svt == 'LOCAL' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} nasm" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} nasm" >> "$GITHUB_ENV"
       shell: bash
     - name: Install zlibpng
       if: ${{ inputs.zlibpng == 'SYSTEM' }}
-      run: echo "AVIF_MAC_LIBRARIES=${{ env.AVIF_MAC_LIBRARIES }} libpng" >> "$GITHUB_ENV"
+      run: echo "AVIF_MAC_LIBRARIES=${AVIF_MAC_LIBRARIES} libpng" >> "$GITHUB_ENV"
       shell: bash
 
     - name: Install libraries
@@ -89,7 +89,7 @@
       run: |
         brew update
         brew cleanup
-        brew install ${{ env.AVIF_MAC_LIBRARIES }}
+        brew install ${AVIF_MAC_LIBRARIES}
       shell: bash
 
     - uses: ./.github/actions/cache

.github/actions/setup-windows/action.yml

diff --git a/.github/actions/setup-windows/action.yml b/.github/actions/setup-windows/action.yml
index a68b08b..5ace229 100644
--- a/.github/actions/setup-windows/action.yml
+++ b/.github/actions/setup-windows/action.yml
@@ -40,7 +40,7 @@
   using: "composite"
   steps:
     - name: Setup Developer Command Prompt for Microsoft Visual C++
-      uses: ilammy/msvc-dev-cmd@v1
+      uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
     - name: Set up meson
       if: ${{ inputs.codec-dav1d == 'LOCAL' }}
       run: pip install meson
@@ -52,27 +52,27 @@
       shell: bash
     - name: Install libdav1d library
       if: ${{ inputs.codec-dav1d == 'SYSTEM' }}
-      run: echo "AVIF_WIN_LIBRARIES=${{ env.AVIF_WIN_LIBRARIES }} dav1d" >> "$GITHUB_ENV"
+      run: echo "AVIF_WIN_LIBRARIES=${AVIF_WIN_LIBRARIES} dav1d" >> "$GITHUB_ENV"
       shell: bash
     - name: Install SVT-AV1 library
       if: ${{ inputs.codec-svt == 'SYSTEM' }}
-      run: echo "AVIF_WIN_LIBRARIES=${{ env.AVIF_WIN_LIBRARIES }} svt-av1" >> "$GITHUB_ENV"
+      run: echo "AVIF_WIN_LIBRARIES=${AVIF_WIN_LIBRARIES} svt-av1" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libjpeg-turbo library
       if: ${{ inputs.libjpeg-turbo == 'SYSTEM' }}
-      run: echo "AVIF_WIN_LIBRARIES=${{ env.AVIF_WIN_LIBRARIES }} libjpeg-turbo" >> "$GITHUB_ENV"
+      run: echo "AVIF_WIN_LIBRARIES=${AVIF_WIN_LIBRARIES} libjpeg-turbo" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libxml2 library
       if: ${{ inputs.libxml2 == 'SYSTEM' }}
-      run: echo "AVIF_WIN_LIBRARIES=${{ env.AVIF_WIN_LIBRARIES }} libxml2" >> "$GITHUB_ENV"
+      run: echo "AVIF_WIN_LIBRARIES=${AVIF_WIN_LIBRARIES} libxml2" >> "$GITHUB_ENV"
       shell: bash
     - name: Install libyuv library
       if: ${{ inputs.libyuv == 'SYSTEM' }}
-      run: echo "AVIF_WIN_LIBRARIES=${{ env.AVIF_WIN_LIBRARIES }} libyuv" >> "$GITHUB_ENV"
+      run: echo "AVIF_WIN_LIBRARIES=${AVIF_WIN_LIBRARIES} libyuv" >> "$GITHUB_ENV"
       shell: bash
     - name: Install zlibpng library
       if: ${{ inputs.zlibpng == 'SYSTEM' }}
-      run: echo "AVIF_WIN_LIBRARIES=${{ env.AVIF_WIN_LIBRARIES }} libpng zlib" >> "$GITHUB_ENV"
+      run: echo "AVIF_WIN_LIBRARIES=${AVIF_WIN_LIBRARIES} libpng zlib" >> "$GITHUB_ENV"
       shell: bash
 
     - name: Install libraries

.github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ee8488f..d5037a7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,3 +13,5 @@
       github-actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7