Improve GitHub Actions workflows

[AFCMS]

• Updates CMake used in the Linux CI to v4.4.3
• Introduces concurrency rules, which will automatically cancel runs considered duplicated (per commit or per PR), saving CI time.
• Pin all actions by hash for supply-chain security hardening, interesting read.
• Configure Dependabot to create a PR per-week to update used actions to their latest tagged version if needed.
• A few additional best-practice fixes.

With this PR, zizmor checks pass with the auditor persona.

# Offline checks
zizmor --persona auditor .
# Online checks (you need the GitHub CLI)
zizmor --gh-token $(gh auth token) --persona auditor .

zizmor could be integrated easily in CI, with integration with GitHub's Advanced Security reporting system.

Summary by CodeRabbit

• Chores
  • Automated weekly checks for GitHub Actions dependencies are now grouped together, with a seven-day cooldown before updates are proposed.
  • Linux and Windows build workflows now use more restricted access permissions and pinned actions.
  • Superseded builds are canceled when a newer run starts for the same change.
  • The Linux build now uses a newer CMake version; Windows compiler target selection remains unchanged.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ec31828e-1867-4e4e-9ed5-2019a4d6d064

📥 Commits

Reviewing files that changed from the base of the PR and between 1f8bd2e and 7bda32f.

📒 Files selected for processing (3)

• .github/dependabot.yml
• .github/workflows/linux_build.yml
• .github/workflows/windows_build.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR adds Dependabot settings for GitHub Actions and updates the Linux and Windows build workflows. The workflows now define permissions and concurrency behavior, use commit-pinned actions, and include platform-specific build setup changes.

Changes

CI Workflow Maintenance

Layer / File(s)	Summary
Action dependency configuration .github/dependabot.yml, .github/workflows/linux_build.yml, .github/workflows/windows_build.yml	Dependabot checks GitHub Actions weekly with a seven-day default cooldown. Both workflows use commit-pinned action references for checkout, Clang setup, ccache, and artifact upload.
Workflow permissions and concurrency .github/workflows/linux_build.yml, .github/workflows/windows_build.yml	Both workflows set empty top-level permissions and cancel in-progress runs in matching concurrency groups. Each build job grants contents: read; the jobs are named Linux and Windows.
Platform build setup .github/workflows/linux_build.yml, .github/workflows/windows_build.yml	The Linux workflow installs CMake 4.4.3 after checksum verification. The Windows workflow sets the architecture-specific compiler target through COMPILER_TARGET.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 7bda3

The workflow and dependency updates have no established behavior that should block merging.

Architecture Summary

Architecture risk: 🔵 Low · up to 7bda3

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: Adds Dependabot configuration for weekly GitHub Actions dependency updates in the repository root, with a seven-day default cooldown and a group matching all patterns.
• observed — Modified behavior in .github/workflows/linux_build.yml: The workflow now sets empty default permissions and concurrency cancellation keyed by workflow plus pull-request number or ref. The build job is named “Linux” and explicitly receives contents: read.
• observed — Modified behavior in .github/workflows/linux_build.yml: Checkout and Clang setup now use commit-pinned action references instead of version tags; their configuration is unchanged.
• observed — Modified behavior in .github/workflows/linux_build.yml: The dependency-install step now exposes the architecture mapping through REL_ARCH in the step environment and downloads, verifies, extracts, and adds CMake 4.4.3 to GITHUB_PATH instead of CMake 4.4.2.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main changes to the GitHub Actions workflows, including CI improvements, pinned action revisions, concurrency controls, and dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}