Secure GitHub actions (#3279) Add persist-credentials: false to every workflow file. See https://docs.zizmor.sh/audits/#template-injection Avoid potential sources of code injection via template expansion in ci-unix-static-av2.yml. See https://docs.zizmor.sh/audits/#template-injection Simplify disabling mechanism in ci-unix-static-av2.yml. See https://docs.zizmor.sh/audits/#obfuscation

diff --git a/.github/workflows/ci-android-emulator-tests.yml b/.github/workflows/ci-android-emulator-tests.yml
index 5c79425..c90da91 100644
--- a/.github/workflows/ci-android-emulator-tests.yml
+++ b/.github/workflows/ci-android-emulator-tests.yml

@@ -30,6 +30,8 @@
     steps:
       - name: Checkout the repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       # This is needed for faster emulators. See:
       # https://github.com/ReactiveCircus/android-emulator-runner?tab=readme-ov-file#running-hardware-accelerated-emulators-on-linux-runners
       - name: Enable KVM group perms

diff --git a/.github/workflows/ci-android-jni.yml b/.github/workflows/ci-android-jni.yml
index cbf0d7a..ee23f6b 100644
--- a/.github/workflows/ci-android-jni.yml
+++ b/.github/workflows/ci-android-jni.yml

@@ -18,6 +18,8 @@
     steps:
       - name: Checkout the repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Download and Setup the Android NDK
         uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1.6.0
         id: setup-ndk

diff --git a/.github/workflows/ci-c-warnings.yml b/.github/workflows/ci-c-warnings.yml
index 0c1c9b3..a5a64b7 100644
--- a/.github/workflows/ci-c-warnings.yml
+++ b/.github/workflows/ci-c-warnings.yml

@@ -25,6 +25,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         with:

diff --git a/.github/workflows/ci-disable-gtest.yml b/.github/workflows/ci-disable-gtest.yml
index ab1a636..70a8180 100644
--- a/.github/workflows/ci-disable-gtest.yml
+++ b/.github/workflows/ci-disable-gtest.yml

@@ -37,6 +37,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         with:
           codec-aom: "LOCAL"

diff --git a/.github/workflows/ci-format-check.yml b/.github/workflows/ci-format-check.yml
index 2a0c774..3d442c1 100644
--- a/.github/workflows/ci-format-check.yml
+++ b/.github/workflows/ci-format-check.yml

@@ -14,6 +14,8 @@
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: RafikFarhad/clang-format-github-action@40f11200e893c5e48dee28fbfe3da60d6862418d # v6
         with:
           style: file
@@ -24,6 +26,8 @@
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: neg-c/cmake-format-action@ba83660ac46d64c12ca96f39478dcde7680a52bf # v0.1.3
         with:
           exclude: libavif.pc.cmake

diff --git a/.github/workflows/ci-fuzztest.yml b/.github/workflows/ci-fuzztest.yml
index ffc1570..ecd8e37 100644
--- a/.github/workflows/ci-fuzztest.yml
+++ b/.github/workflows/ci-fuzztest.yml

@@ -28,6 +28,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         id: setup
         with:

diff --git a/.github/workflows/ci-linux-artifacts.yml b/.github/workflows/ci-linux-artifacts.yml
index d9037b9..b52cd3f 100644
--- a/.github/workflows/ci-linux-artifacts.yml
+++ b/.github/workflows/ci-linux-artifacts.yml

@@ -18,6 +18,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         with:
           codec-aom: "LOCAL"

diff --git a/.github/workflows/ci-linux-coverage.yml b/.github/workflows/ci-linux-coverage.yml
index 2b55e43..750cd4e 100644
--- a/.github/workflows/ci-linux-coverage.yml
+++ b/.github/workflows/ci-linux-coverage.yml

@@ -21,6 +21,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         id: setup
         with:

diff --git a/.github/workflows/ci-linux-golden-tests.yml b/.github/workflows/ci-linux-golden-tests.yml
index 9328d0a..cef80db 100644
--- a/.github/workflows/ci-linux-golden-tests.yml
+++ b/.github/workflows/ci-linux-golden-tests.yml

@@ -27,6 +27,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         id: setup
         with:

diff --git a/.github/workflows/ci-linux-oldest-cmake.yml b/.github/workflows/ci-linux-oldest-cmake.yml
index b54d0ca..70511ee 100644
--- a/.github/workflows/ci-linux-oldest-cmake.yml
+++ b/.github/workflows/ci-linux-oldest-cmake.yml

@@ -21,6 +21,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         with:
           codec-aom: "LOCAL"

diff --git a/.github/workflows/ci-macos-artifacts.yml b/.github/workflows/ci-macos-artifacts.yml
index ca74eb1..91cf05c 100644
--- a/.github/workflows/ci-macos-artifacts.yml
+++ b/.github/workflows/ci-macos-artifacts.yml

@@ -18,6 +18,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-macos
         with:
           codec-aom: "LOCAL"

diff --git a/.github/workflows/ci-mingw.yml b/.github/workflows/ci-mingw.yml
index 603ec47..b2093a5 100644
--- a/.github/workflows/ci-mingw.yml
+++ b/.github/workflows/ci-mingw.yml

@@ -27,6 +27,8 @@
         shell: msys2 {0}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: ${{ matrix.sys }}

diff --git a/.github/workflows/ci-unix-shared-installed.yml b/.github/workflows/ci-unix-shared-installed.yml
index d5e04d0..53a07c6 100644
--- a/.github/workflows/ci-unix-shared-installed.yml
+++ b/.github/workflows/ci-unix-shared-installed.yml

@@ -35,6 +35,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         with:

diff --git a/.github/workflows/ci-unix-shared-local.yml b/.github/workflows/ci-unix-shared-local.yml
index 7361440..9227cb5 100644
--- a/.github/workflows/ci-unix-shared-local.yml
+++ b/.github/workflows/ci-unix-shared-local.yml

@@ -30,6 +30,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         with:

diff --git a/.github/workflows/ci-unix-static-av2.yml b/.github/workflows/ci-unix-static-av2.yml
index bdd2921..2681569 100644
--- a/.github/workflows/ci-unix-static-av2.yml
+++ b/.github/workflows/ci-unix-static-av2.yml

@@ -31,6 +31,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         with:
           codec-aom: "LOCAL"
@@ -71,9 +73,9 @@
         shell: bash
       - name: Check static link bundling
         # Disabled until libavm properly depends on tensorflow-lite.
-        if: ${{ false }}
+        if: false
         run: |
-          ${{ env.CC }} -o avifenc  -I./apps/shared -I./third_party/iccjpeg -I./include apps/avifenc.c \
+          ${CC} -o avifenc  -I./apps/shared -I./third_party/iccjpeg -I./include apps/avifenc.c \
             apps/shared/*.c third_party/iccjpeg/iccjpeg.c build/libavif.a \
             -lpng -ljpeg -lz -lm -ldl -lstdc++
 

diff --git a/.github/workflows/ci-unix-static-sanitized-memory.yml b/.github/workflows/ci-unix-static-sanitized-memory.yml
index 7433bbd..1281346 100644
--- a/.github/workflows/ci-unix-static-sanitized-memory.yml
+++ b/.github/workflows/ci-unix-static-sanitized-memory.yml

@@ -20,6 +20,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         id: setup_linux

diff --git a/.github/workflows/ci-unix-static-sanitized.yml b/.github/workflows/ci-unix-static-sanitized.yml
index f38ec95..c608855 100644
--- a/.github/workflows/ci-unix-static-sanitized.yml
+++ b/.github/workflows/ci-unix-static-sanitized.yml

@@ -28,6 +28,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         id: setup_linux

diff --git a/.github/workflows/ci-unix-static.yml b/.github/workflows/ci-unix-static.yml
index 0722b92..d3fb415 100644
--- a/.github/workflows/ci-unix-static.yml
+++ b/.github/workflows/ci-unix-static.yml

@@ -32,6 +32,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         with:

diff --git a/.github/workflows/ci-windows-artifacts.yml b/.github/workflows/ci-windows-artifacts.yml
index b99f6ff..15b98e8 100644
--- a/.github/workflows/ci-windows-artifacts.yml
+++ b/.github/workflows/ci-windows-artifacts.yml

@@ -18,6 +18,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-windows
         id: setup
         with:

diff --git a/.github/workflows/ci-windows-installed.yml b/.github/workflows/ci-windows-installed.yml
index d4ecb95..ee4a2b8 100644
--- a/.github/workflows/ci-windows-installed.yml
+++ b/.github/workflows/ci-windows-installed.yml

@@ -26,6 +26,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-windows
         id: setup
         with:

diff --git a/.github/workflows/ci-windows-shared-local.yml b/.github/workflows/ci-windows-shared-local.yml
index a6f15b7..4b9a66e 100644
--- a/.github/workflows/ci-windows-shared-local.yml
+++ b/.github/workflows/ci-windows-shared-local.yml

@@ -29,6 +29,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-windows
         with:
           codec-aom: "LOCAL"

diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
index 1647a10..337b7d9 100644
--- a/.github/workflows/ci-windows.yml
+++ b/.github/workflows/ci-windows.yml

@@ -37,6 +37,8 @@
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-windows
         id: setup
         with: