Every reusable workflow call used 'secrets: inherit', which hands the
caller's whole secret set to the called workflow, but the only secret
any of them reads is SIGNPATH_API_TOKEN in build-windows-hosts.yml.
Passing that one secret explicitly and dropping inherit everywhere else
means a compromised step in, say, a BSD build VM has no signing token
to steal, and the workflow files now show exactly which secret flows
where.
The secret is declared optional in the reusable workflow so runs
without it (pull requests, forks) behave as before; the signing step
is already guarded to upstream push events.
A version tag like @v1 or a branch like @master is a movable pointer:
whoever controls the action repository can re-point it, and the next
run executes whatever it points at. Several of these actions run in
jobs whose outputs ship to users: build-release.yml creates the GitHub
release with the downloadable binaries, and build-windows-hosts.yml
holds the SignPath signing token, so a re-pointed tag there could ship
a tampered or wrongly signed release. This is exactly how the
tj-actions/changed-files compromise propagated (CVE-2025-30066).
Pinning by full commit SHA makes the reviewed code the code that runs,
the same way docker/setup-qemu-action is already pinned in
build-linux-vms.yml. Refs that pointed at master (cross-platform-actions,
setup-alpine, get-latest-release) are pinned to their latest release
tag. Every pin keeps a version comment, and each SHA was resolved from
the upstream repository and cross-checked against its release tag.
The minimal (core) installation ships the `ubuntustudio-desktop-core`
metapackage instead of `ubuntustudio-desktop`, so the existing check
missed it and the system was reported as Kubuntu.
Fixes#2485
- Add missing ffStrbufDestroy(&options->outputColor) in ffDestroySeparatorOptions
to prevent memory leak when outputColor is set via JSON config
- Replace two exit(1) calls in ffPreparePublicIp with proper error status
propagation, matching the pattern used in the weather module
- Add missing ffStrbufDestroy(&options->outputColor) in ffDestroySeparatorOptions
to prevent memory leak when outputColor is set via JSON config
- Replace two exit(1) calls in ffPreparePublicIp with proper error status
propagation, matching the pattern used in the weather module
The redundant `if (index < strbuf->length)` check inside the static string
branch is always true since `strbuf->length <= index` is already checked
at the top of the function and returns false. Remove this dead code for clarity.
Co-authored-by: tru3 <tru3@tru3.com>
- Add missing ffStrbufDestroy(&options->location) in ffDestroyWeatherOptions
to prevent memory leak when location is set via config
- Replace exit(1) in ffPrepareWeather with setting status to an error string,
allowing the error to be properly propagated through the existing error mechanism
Co-authored-by: tru3 <tru3@tru3.com>
* CI: add loong64 build workflow
Add reusable workflow for building fastfetch on LoongArch 64-bit
architecture using QEMU user-mode emulation + Docker container
(lcr.loongnix.cn/debian:14). Integrate into CI pipeline and
release dependencies.
* CI (loong64): pin docker/setup-qemu-action to full commit SHA
Pin to 06116385d9baf250c9f4dcb4858b16962ea869c3 (v4.1.0) for
immutable action reference as required by Codacy.
Thibaud-Vdb