From 14bc4036faa94ef5e62922555eb30daea8f67d87 Mon Sep 17 00:00:00 2001
From: Ralph Lange <ralph.lange@gmx.de>
Date: Tue, 28 Jul 2026 09:59:42 +0200
Subject: [PATCH 1/3] ci: update GitHub Actions configuration

- limit required permissions
- bump actions/checkout v3 -> v7.0.1; use commit hash
- bump coverallsapp/github-action v2 -> v2.3.8; use commit hash
- zizmor linter now reports no findings on the workflow
  (previously 2 high + 2 medium)
---
 .github/workflows/ci-scripts.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-scripts.yml b/.github/workflows/ci-scripts.yml
index 62dedbc9b..ffdd06568 100644
--- a/.github/workflows/ci-scripts.yml
+++ b/.github/workflows/ci-scripts.yml
@@ -13,6 +13,9 @@ on:
       - '**/*.txt'
   pull_request:
 
+permissions:
+  contents: read
+
 env:
   SETUP_PATH: .ci-local:.ci
 
@@ -98,9 +101,10 @@ jobs:
             base: "7.0"
             deps: adsupport
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
+        persist-credentials: false
 
     - name: Install TIRPC Headers
       if: runner.os == 'Linux'
@@ -210,7 +214,7 @@ jobs:
 
     - name: Upload to Coveralls
       if: ${{ matrix.coverage }}
-      uses: coverallsapp/github-action@v2
+      uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
       with:
         file: ci/coverage.info
         format: lcov

From 637f9efd9d0d3c3c20fd8ac2b1ed9b2342d5bab7 Mon Sep 17 00:00:00 2001
From: Ralph Lange <ralph.lange@gmx.de>
Date: Tue, 28 Jul 2026 10:10:46 +0200
Subject: [PATCH 2/3] ci: add GHA jobs for Windows2025 / VS2026

---
 .github/workflows/ci-scripts.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/ci-scripts.yml b/.github/workflows/ci-scripts.yml
index ffdd06568..dba13e951 100644
--- a/.github/workflows/ci-scripts.yml
+++ b/.github/workflows/ci-scripts.yml
@@ -100,6 +100,21 @@ jobs:
             configuration: static
             base: "7.0"
             deps: adsupport
+
+          - name: Win2025 Base7.0 DLL
+            os: windows-2025
+            cmp: vs2026
+            configuration: default
+            base: "7.0"
+            deps: adsupport
+
+          - name: Win2025 Base7.0 static
+            os: windows-2025
+            cmp: vs2026
+            configuration: static
+            base: "7.0"
+            deps: adsupport
+
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:

From 41291f1db0df1e49148c76a83a4d0229660afccd Mon Sep 17 00:00:00 2001
From: Ralph Lange <ralph.lange@gmx.de>
Date: Tue, 28 Jul 2026 10:20:46 +0200
Subject: [PATCH 3/3] ci: update ci-scripts to v3.4.3

- adds support for Windows2025/VS2026
---
 .ci | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.ci b/.ci
index 261f218e0..a32a1dab0 160000
--- a/.ci
+++ b/.ci
@@ -1 +1 @@
-Subproject commit 261f218e094e39550e3a7c54b98e34adcf42ad9b
+Subproject commit a32a1dab0586dde3f5b2990506d54950e61ce25b