From b6b8b233499a8d1e70e8cce93ddc802d83af75f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 14:14:47 +0000
Subject: [PATCH 01/42] checks: Enable GitHub Actions validation in
 super-linter

---
 .github/workflows/super-linter.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/super-linter.yml b/.github/workflows/super-linter.yml
index c22d712e9a2..65aba4a21b8 100644
--- a/.github/workflows/super-linter.yml
+++ b/.github/workflows/super-linter.yml
@@ -53,6 +53,7 @@ jobs:
           # VALIDATE_CSS: true
           # VALIDATE_DOCKER: true
           VALIDATE_EDITORCONFIG: true
+          VALIDATE_GITHUB_ACTIONS: true
           VALIDATE_JAVASCRIPT_ES: true
           # VALIDATE_JAVASCRIPT_STANDARD: true
           VALIDATE_JSON: true

From 164062bca19b474211b76a71cebbf59efb64cbd0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 16:12:50 +0000
Subject: [PATCH 02/42] checks: Enable GitHub Actions zizmor validation in
 super-linter

---
 .github/workflows/super-linter.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/super-linter.yml b/.github/workflows/super-linter.yml
index 65aba4a21b8..df68b160316 100644
--- a/.github/workflows/super-linter.yml
+++ b/.github/workflows/super-linter.yml
@@ -54,6 +54,7 @@ jobs:
           # VALIDATE_DOCKER: true
           VALIDATE_EDITORCONFIG: true
           VALIDATE_GITHUB_ACTIONS: true
+          VALIDATE_GITHUB_ACTIONS_ZIZMOR: true
           VALIDATE_JAVASCRIPT_ES: true
           # VALIDATE_JAVASCRIPT_STANDARD: true
           VALIDATE_JSON: true

From 6b2abd68ac1fd23962cf8dd1910b3d96ec69ed43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 17:42:51 +0000
Subject: [PATCH 03/42] CI: Limit additional_checks.yml permissions to
 contents: read

---
 .github/workflows/additional_checks.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/additional_checks.yml b/.github/workflows/additional_checks.yml
index edd4a3eff67..21beb7a9d46 100644
--- a/.github/workflows/additional_checks.yml
+++ b/.github/workflows/additional_checks.yml
@@ -23,6 +23,8 @@ jobs:
   additional-checks:
     name: Additional checks
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository contents

From 13d3a9a693e7b38315897265ab5345982227bddf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 18:03:17 +0000
Subject: [PATCH 04/42] CI: Avoid potential template injection issue in
 create-upload-suggestions

Solves zizmor's template-injection audit: https://docs.zizmor.sh/audits/#template-injection
---
 .github/actions/create-upload-suggestions/action.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/actions/create-upload-suggestions/action.yml b/.github/actions/create-upload-suggestions/action.yml
index b84e7885d00..1e66626a332 100644
--- a/.github/actions/create-upload-suggestions/action.yml
+++ b/.github/actions/create-upload-suggestions/action.yml
@@ -145,7 +145,9 @@ runs:
     - name: List all changed files tracked and untracked files
       shell: bash
       run: |
-        echo "Changed files: ${{ steps.git-changed-files.outputs.CHANGED_FILES }}"
+        echo "Changed files: ${CHANGED_FILES}"
+      env:
+        CHANGED_FILES: ${{ steps.git-changed-files.outputs.CHANGED_FILES }}
     - name: Add job summary without changed files
       shell: bash
       if: ${{ steps.files_changed.outputs.files_changed == 'false' }}

From 009af6c08f88b697cea4c36835626ac57a6b2848 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 19:12:06 +0000
Subject: [PATCH 05/42] CI: Address actionlint/shellcheck issues in macos.yml
 workflow

---
 .github/workflows/macos.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index bf69076a83a..d3d704c49a1 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -65,7 +65,7 @@ jobs:
             pyyaml
         run: |
           cp ./macos/files/conda-requirements-dev-arm64.txt "${RUNNER_TEMP}/macos_dependencies.txt"
-          echo "$test_dependencies" | sed "s/ /\n/g" >> "${RUNNER_TEMP}/macos_dependencies.txt"
+          echo "${test_dependencies// /\n}" >> "${RUNNER_TEMP}/macos_dependencies.txt"
       - name: Setup Mamba
         uses: mamba-org/setup-micromamba@b09ef9b599704322748535812ca03efb2625677b # v2.0.5
         with:
@@ -81,12 +81,12 @@ jobs:
           printenv | sort
           $CC --version
       - name: Create installation directory
-        run: mkdir $HOME/install
+        run: mkdir "${HOME}/install"
       - name: Build and install
         shell: micromamba-shell {0}
-        run: source ./.github/workflows/macos_install.sh $HOME/install
+        run: source ./.github/workflows/macos_install.sh "${HOME}/install"
       - name: Add the bin directory to PATH
-        run: echo "$HOME/install/bin" >> $GITHUB_PATH
+        run: echo "${HOME}/install/bin" >> "${GITHUB_PATH}"
       - name: Check installed version
         if: ${{ !cancelled() }}
         shell: micromamba-shell {0}

From 2e6bcbecf2f6cb72f32d666b44725e29b41e098b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 19:37:24 +0000
Subject: [PATCH 06/42] CI: Address actionlint/shellcheck issues in macos.yml
 workflow

---
 .github/workflows/macos.yml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index d3d704c49a1..c11172c35d5 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -95,8 +95,10 @@ jobs:
       - name: Run pytest with multiple workers in parallel
         shell: micromamba-shell {0}
         run: |
-          export PYTHONPATH=$(grass --config python_path):$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
+          PYTHONPATH="$(grass --config python_path):${PYTHONPATH}"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:${LD_LIBRARY_PATH}"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
           pytest \
             @.github/workflows/pytest_args_ci.txt \
             @.github/workflows/pytest_args_parallel.txt \
@@ -105,8 +107,10 @@ jobs:
       - name: Run pytest with a single worker (for tests marked with needs_solo_run)
         shell: micromamba-shell {0}
         run: |
-          export PYTHONPATH=$(grass --config python_path):$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
+          PYTHONPATH="$(grass --config python_path):${PYTHONPATH}"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:${LD_LIBRARY_PATH}"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
           pytest \
             @.github/workflows/pytest_args_ci.txt \
             @.github/workflows/pytest_args_not_parallel.txt \
@@ -115,8 +119,10 @@ jobs:
       - name: Run pytest with a single worker (for gunittest-based tests)
         shell: micromamba-shell {0}
         run: |
-          export PYTHONPATH=$(grass --config python_path):$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
+          PYTHONPATH="$(grass --config python_path):${PYTHONPATH}"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:${LD_LIBRARY_PATH}"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
           pytest \
             @.github/workflows/pytest_args_gunittest.txt \
             --junitxml=pytest.gunittest.junit.xml

From 976351625a1809844753c5ddf4d9354ad3f1bce4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 19:39:00 +0000
Subject: [PATCH 07/42] CI: Address actionlint/shellcheck issues in
 additional_checks.yml workflow

---
 .github/workflows/additional_checks.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/additional_checks.yml b/.github/workflows/additional_checks.yml
index 21beb7a9d46..dc339ac755b 100644
--- a/.github/workflows/additional_checks.yml
+++ b/.github/workflows/additional_checks.yml
@@ -58,8 +58,8 @@ jobs:
           # Using the last 30 commits (for branches, tags, and PRs).
           # End is the current (latest) commit.
           python ./utils/generate_release_notes.py log \
-              ${{ github.ref_name }} \
-              $(git rev-parse HEAD~30) \
+              "${GITHUB_REF_NAME}" \
+              "$(git rev-parse HEAD~30)" \
               ""
       - name: "Cache pre-commit"
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4

From 1ea3218250dec986eb4f9ec19c607c07bdebeb85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 19:58:45 +0000
Subject: [PATCH 08/42] CI: Address actionlint/shellcheck and zizmor issues in
 cmake.yml workflow

- Use env vars directly instead of template substitution
- This includes renaming env var CMakeVersion to CMAKE_VERSION
- Double quote variables, and add braces
---
 .github/workflows/cmake.yml | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index 86d8eac2833..2c2da832994 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -26,7 +26,7 @@ jobs:
   build-cmake:
     runs-on: ubuntu-22.04
     env:
-      CMakeVersion: "3.22.0"
+      CMAKE_VERSION: "3.22.0"
     steps:
       - name: Checkout GRASS
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -34,13 +34,13 @@ jobs:
           persist-credentials: false
       - name: Install CMake
         run: |
-          cd ${GITHUB_WORKSPACE}
-          arch=$(echo $(uname -s)-$(uname -m) | awk '{print tolower($0)}')
-          v=v${{ env.CMakeVersion }}/cmake-${{ env.CMakeVersion }}-${arch}.tar.gz
-          wget https://github.com/Kitware/CMake/releases/download/$v
-          tar xzf cmake-${{ env.CMakeVersion }}-${arch}.tar.gz
-          echo "CMAKE_DIR=$GITHUB_WORKSPACE/cmake-${{ env.CMakeVersion }}-${arch}/bin" >> $GITHUB_ENV
-          echo "$GITHUB_WORKSPACE/cmake-${{ env.CMakeVersion }}-${arch}/bin" >> $GITHUB_PATH
+          cd "${GITHUB_WORKSPACE}" || exit
+          arch="$(echo "$(uname -s)"-"$(uname -m)" | awk '{print tolower($0)}')"
+          v="v${CMAKE_VERSION}/cmake-${CMAKE_VERSION}-${arch}.tar.gz"
+          wget "https://github.com/Kitware/CMake/releases/download/$v"
+          tar xzf "cmake-${CMAKE_VERSION}-${arch}.tar.gz"
+          echo "CMAKE_DIR=${GITHUB_WORKSPACE}/cmake-${CMAKE_VERSION}-${arch}/bin" >> "${GITHUB_ENV}"
+          echo "${GITHUB_WORKSPACE}/cmake-${CMAKE_VERSION}-${arch}/bin" >> "${GITHUB_PATH}"
       - run: |
           cmake --version
       - name: Install dependencies
@@ -58,25 +58,25 @@ jobs:
           ldd --version
       - name: Create installation directory
         run: |
-          mkdir $HOME/install
+          mkdir "${HOME}/install"
       - name: Configure
         run: |
-          cmake ${CMAKE_OPTIONS} -S $GITHUB_WORKSPACE -B $GITHUB_WORKSPACE/build -G Ninja \
-            -DCMAKE_INSTALL_PREFIX=$HOME/install -DWITH_NLS=ON -DWITH_GUI=OFF -DWITH_DOCS=OFF \
+          cmake ${CMAKE_OPTIONS} -S "${GITHUB_WORKSPACE}" -B "${GITHUB_WORKSPACE}/build" -G Ninja \
+            -DCMAKE_INSTALL_PREFIX="${HOME}/install" -DWITH_NLS=ON -DWITH_GUI=OFF -DWITH_DOCS=OFF \
             -DWITH_READLINE=ON -DWITH_ODBC=ON -DWITH_NETCDF=ON -DWITH_BZLIB=ON
       - name: Print CMakeCache.txt
         shell: bash -el {0}
         run: |
-          cat ${GITHUB_WORKSPACE}/build/CMakeCache.txt
+          cat "${GITHUB_WORKSPACE}/build/CMakeCache.txt"
       - name: Build
         run: |
-          cmake --build build --verbose -j$(nproc)
+          cmake --build build --verbose -j"$(nproc)"
       - name: Install
         run: |
-          cmake --install $GITHUB_WORKSPACE/build --verbose
+          cmake --install "${GITHUB_WORKSPACE}/build" --verbose
       - name: Add the bin directory to PATH
         run: |
-          echo "$HOME/install/bin" >> $GITHUB_PATH
+          echo "${HOME}/install/bin" >> "${GITHUB_PATH}"
       - name: Print installed versions
         if: always()
         run: .github/workflows/print_versions.sh

From e81c91ada42936dab49acd3fe9cec2007819129c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 20:01:40 +0000
Subject: [PATCH 09/42] CI(cmake): Remove unused CMAKE_OPTIONS env var, that
 shouldn't be double quoted if ever used

---
 .github/workflows/cmake.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index 2c2da832994..a8f9fa0bf2e 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -61,7 +61,7 @@ jobs:
           mkdir "${HOME}/install"
       - name: Configure
         run: |
-          cmake ${CMAKE_OPTIONS} -S "${GITHUB_WORKSPACE}" -B "${GITHUB_WORKSPACE}/build" -G Ninja \
+          cmake -S "${GITHUB_WORKSPACE}" -B "${GITHUB_WORKSPACE}/build" -G Ninja \
             -DCMAKE_INSTALL_PREFIX="${HOME}/install" -DWITH_NLS=ON -DWITH_GUI=OFF -DWITH_DOCS=OFF \
             -DWITH_READLINE=ON -DWITH_ODBC=ON -DWITH_NETCDF=ON -DWITH_BZLIB=ON
       - name: Print CMakeCache.txt

From cee59d47aab46640eeda90ba506f6e372e8d4350 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 20:14:02 +0000
Subject: [PATCH 10/42] CI: Address actionlint/shellcheck and zizmor issues in
 coverity.yml workflow

- Use env vars directly instead of template substitution
- Double quote variables, and add braces
- Declare and assign exported env vars separately to avoid masking return values. (SC2155)
---
 .github/workflows/coverity.yml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index fb288db5db4..81a8d32403b 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -30,7 +30,7 @@ jobs:
 
       - name: Create installation directory
         run: |
-          mkdir $HOME/install
+          mkdir "${HOME}/install"
 
       - name: Download Coverity Build Tool
         run: |
@@ -43,11 +43,11 @@ jobs:
 
       - name: Set number of cores for compilation
         run: |
-          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
+          echo "MAKEFLAGS=-j$(nproc)" >> "${GITHUB_ENV}"
 
       - name: Set LD_LIBRARY_PATH for compilation
         run: |
-          echo "LD_LIBRARY_PATH=$HOME/install/lib" >> $GITHUB_ENV
+          echo "LD_LIBRARY_PATH=${HOME}/install/lib" >> "${GITHUB_ENV}"
 
       - name: Print build environment variables
         run: |
@@ -57,11 +57,11 @@ jobs:
 
       - name: Configure
         run: |
-          echo "CFLAGS=${{ env.CFLAGS }}" >> $GITHUB_ENV
-          echo "CXXFLAGS=${{ env.CXXFLAGS }}" >> $GITHUB_ENV
+          echo "CFLAGS=${CFLAGS}" >> "${GITHUB_ENV}"
+          echo "CXXFLAGS=${CXXFLAGS}" >> "${GITHUB_ENV}"
           ./configure \
               --enable-largefile \
-              --prefix="$HOME/install/" \
+              --prefix="${HOME}/install/" \
               --with-blas \
               --with-bzlib \
               --with-cxx \
@@ -87,7 +87,8 @@ jobs:
       - name: Build with cov-build
         run: |
           pwd
-          export PATH="$(pwd)/cov-analysis-linux64/bin:${PATH}"
+          PATH="$(pwd)/cov-analysis-linux64/bin:${PATH}"
+          export PATH
           cov-build --dir cov-int make
 
       - name: Put results into Tarball

From 404fc61651c239632041f110aab349e2f3607cf3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 20:47:59 +0000
Subject: [PATCH 11/42] CI(docker): Address actionlint/shellcheck and zizmor
 issues in docker.yml workflow

---
 .github/workflows/docker.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ff78915cd18..8db5f42b5ee 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -105,9 +105,9 @@ jobs:
             || github.ref == format('refs/heads/{0}', steps.tag-branch.outputs.latest_rel_branch)
           }}"
           echo "latest=${latest}" >> "${GITHUB_OUTPUT}"
-          echo "latest is $latest"
+          echo "latest is ${latest}"
           echo "current=${current}" >> "${GITHUB_OUTPUT}"
-          echo "current is $current"
+          echo "current is ${current}"
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
@@ -160,7 +160,9 @@ jobs:
                 && format('type=gha,scope={0}', matrix.os) || '' }}
           cache-to: type=gha,mode=max,scope=${{ matrix.os }}
       - name: Image digest
-        run: echo ${{ steps.docker_build.outputs.digest }}
+        run: echo "${STEPS_DOCKER_BUILD_OUTPUTS_DIGEST}"
+        env:
+          STEPS_DOCKER_BUILD_OUTPUTS_DIGEST: ${{ steps.docker_build.outputs.digest }}
       - name: Attest docker.io image
         uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
         # If there isn't a digest, an annotation cannot be added

From 444d51b236768fb5584cbb1c94740dec9b26f0b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 20:53:06 +0000
Subject: [PATCH 12/42] CI: Address actionlint/shellcheck and zizmor issues in
 create_release_draft.yml workflow

---
 .github/workflows/create_release_draft.yml | 26 +++++++++++-----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/create_release_draft.yml b/.github/workflows/create_release_draft.yml
index 6b0e2db5f14..1e863cf4aea 100644
--- a/.github/workflows/create_release_draft.yml
+++ b/.github/workflows/create_release_draft.yml
@@ -41,12 +41,12 @@ jobs:
           python-version: '3.13'
       - name: Create output directory
         run: |
-          mkdir ${{ env.OUT_DIR }}
+          mkdir "${OUT_DIR}"
       - name: Generate ChangeLog file
         run: |
           python utils/gitlog2changelog.py
-          mv ChangeLog ${{ env.OUT_DIR }}/ChangeLog
-          gzip ${{ env.OUT_DIR }}/ChangeLog
+          mv ChangeLog "${OUT_DIR}/ChangeLog"
+          gzip "${OUT_DIR}/ChangeLog"
       - name: Generate Git derived data files
         run: |
           echo "Generate VERSION_GIT file:"
@@ -58,21 +58,21 @@ jobs:
           echo "Create core modules patch file:"
           git add core_modules_with_last_commit.json
           git diff --cached > \
-            ${{ env.OUT_DIR }}/core_modules_with_last_commit.patch
+            "${OUT_DIR}/core_modules_with_last_commit.patch"
       - name: Create tarballs (for tags only)
         if: startsWith(github.ref, 'refs/tags/')
         run: |
           cd ..
-          tar -cvf ${{ env.OUT_DIR }}/${{ env.GRASS }}.tar \
+          tar -cvf "${OUT_DIR}/${GRASS}.tar" \
             --exclude=".gi*" --exclude=".tr*" \
-            --transform s/grass/${{ env.GRASS }}/ grass
-          cd ${{ env.OUT_DIR }}
-          gzip -9k ${{ env.GRASS }}.tar
-          md5sum ${{ env.GRASS }}.tar.gz > ${{ env.GRASS }}.tar.gz.md5
-          sha256sum ${{ env.GRASS }}.tar.gz > ${{ env.GRASS }}.tar.gz.sha256
-          xz -9e ${{ env.GRASS }}.tar
-          md5sum ${{ env.GRASS }}.tar.xz > ${{ env.GRASS }}.tar.xz.md5
-          sha256sum ${{ env.GRASS }}.tar.xz > ${{ env.GRASS }}.tar.xz.sha256
+            --transform s/grass/"${GRASS}"/ grass
+          cd "${OUT_DIR}" || exit
+          gzip -9k "${GRASS}.tar"
+          md5sum "${GRASS}.tar.gz" > "${GRASS}.tar.gz.md5"
+          sha256sum "${GRASS}.tar.gz" > "${GRASS}.tar.gz.sha256"
+          xz -9e "${GRASS}.tar"
+          md5sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.md5"
+          sha256sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.sha256"
       - name: Publish draft distribution to GitHub (for tags only)
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2

From 4ac5fc0a92f61d7fc7521712cd98fa270a47f918 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 20:53:53 +0000
Subject: [PATCH 13/42] DEBUG: Test create tarball with changes done below

---
 .github/workflows/create_release_draft.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/create_release_draft.yml b/.github/workflows/create_release_draft.yml
index 1e863cf4aea..58ba032bd63 100644
--- a/.github/workflows/create_release_draft.yml
+++ b/.github/workflows/create_release_draft.yml
@@ -59,6 +59,19 @@ jobs:
           git add core_modules_with_last_commit.json
           git diff --cached > \
             "${OUT_DIR}/core_modules_with_last_commit.patch"
+      - name: Test create tarballs
+        run: |
+          cd ..
+          tar -cvf "${OUT_DIR}/${GRASS}.tar" \
+            --exclude=".gi*" --exclude=".tr*" \
+            --transform s/grass/"${GRASS}"/ grass
+          cd "${OUT_DIR}" || exit
+          gzip -9k "${GRASS}.tar"
+          md5sum "${GRASS}.tar.gz" > "${GRASS}.tar.gz.md5"
+          sha256sum "${GRASS}.tar.gz" > "${GRASS}.tar.gz.sha256"
+          xz -9e "${GRASS}.tar"
+          md5sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.md5"
+          sha256sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.sha256"
       - name: Create tarballs (for tags only)
         if: startsWith(github.ref, 'refs/tags/')
         run: |

From af58dd005fa72180430b070a10dea336c8e1f630 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:11:14 +0000
Subject: [PATCH 14/42] DEBUG: Test create tarball with GRASS env var overriden
 like when tag is used

---
 .github/workflows/create_release_draft.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/create_release_draft.yml b/.github/workflows/create_release_draft.yml
index 58ba032bd63..c121cdcc326 100644
--- a/.github/workflows/create_release_draft.yml
+++ b/.github/workflows/create_release_draft.yml
@@ -62,6 +62,7 @@ jobs:
       - name: Test create tarballs
         run: |
           cd ..
+          GRASS="grass-8.4.1"
           tar -cvf "${OUT_DIR}/${GRASS}.tar" \
             --exclude=".gi*" --exclude=".tr*" \
             --transform s/grass/"${GRASS}"/ grass

From 5a3c22aa643865ccc7f306676109e99bf092c6b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:25:18 +0000
Subject: [PATCH 15/42] CI: Address actionlint/shellcheck and zizmor issues in
 ubuntu.yml workflow

---
 .github/workflows/ubuntu.yml | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 23f7dd0e21b..cc57781f025 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -73,12 +73,13 @@ jobs:
           temporal testsuite utils vector visualization)
           echo "Complete set of folders that can be included:"
           echo "${array[@]}"
-          delete=( ${{ env.DELETE_ARRAY }} )
+          # shellcheck disable=SC2206
+          delete=( ${DELETE_ARRAY} )
           echo "Included folders to remove from the complete set:"
           echo "${delete[@]}"
           for target in "${delete[@]}"; do
             for i in "${!array[@]}"; do
-              if [[ ${array[i]} = $target ]]; then
+              if [[ ${array[i]} = "${target}" ]]; then
                 unset 'array[i]'
               fi
             done
@@ -98,10 +99,10 @@ jobs:
 
       - name: Add extra exclusions to a gunittest config file
         run: |
-          sed 's:exclude =:exclude = ${{
-            steps.get-exclude.outputs.extra-exclude
-          }}:g' .gunittest.cfg > .gunittest.extra.cfg
+          sed "s:exclude =:exclude = ${STEPS_GET_EXCLUDE_OUTPUTS_EXTRA_EXCLUDE}:g" .gunittest.cfg > .gunittest.extra.cfg
           cat .gunittest.extra.cfg
+        env:
+          STEPS_GET_EXCLUDE_OUTPUTS_EXTRA_EXCLUDE: ${{ steps.get-exclude.outputs.extra-exclude }}
 
       - name: Get dependencies
         run: |
@@ -112,15 +113,15 @@ jobs:
 
       - name: Create installation directory
         run: |
-          mkdir $HOME/install
+          mkdir "${HOME}/install"
 
       - name: Set number of cores for compilation
         run: |
-          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
+          echo "MAKEFLAGS=-j$(nproc)" >> "${GITHUB_ENV}"
 
       - name: Set LD_LIBRARY_PATH for compilation
         run: |
-          echo "LD_LIBRARY_PATH=$HOME/install/lib" >> $GITHUB_ENV
+          echo "LD_LIBRARY_PATH=${HOME}/install/lib" >> "${GITHUB_ENV}"
 
       - name: Print build environment variables
         shell: bash -el {0}
@@ -135,11 +136,11 @@ jobs:
           CFLAGS: -fPIC -Wvla -ffp-contract=off
           # TODO: -pedantic-errors here won't compile
           CXXFLAGS: -fPIC -ffp-contract=off
-        run: .github/workflows/build_${{ matrix.config }}.sh $HOME/install -Werror
+        run: .github/workflows/build_${{ matrix.config }}.sh "${HOME}/install" -Werror
 
       - name: Add the bin directory to PATH
         run: |
-          echo "$HOME/install/bin" >> $GITHUB_PATH
+          echo "${HOME}/install/bin" >> "${GITHUB_PATH}"
 
       - name: Print installed versions
         if: always()
@@ -160,7 +161,7 @@ jobs:
         if: steps.cached-data.outputs.cache-hit != 'true'
         run: |
           mkdir -p sample-data
-          curl -L "$SAMPLE_DATA" -o sample-data/nc_spm_full_v2alpha2.tar.gz
+          curl -L "${SAMPLE_DATA}" -o sample-data/nc_spm_full_v2alpha2.tar.gz
         env:
           SAMPLE_DATA: "https://grass.osgeo.org/sampledata/north_carolina/\
             nc_spm_full_v2alpha2.tar.gz"

From 3532cd321a674a7bad1154b0ba36e24d0d27e076 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:27:01 +0000
Subject: [PATCH 16/42] Revert: Test create tarball with changes done below

---
 .github/workflows/create_release_draft.yml | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/.github/workflows/create_release_draft.yml b/.github/workflows/create_release_draft.yml
index c121cdcc326..1e863cf4aea 100644
--- a/.github/workflows/create_release_draft.yml
+++ b/.github/workflows/create_release_draft.yml
@@ -59,20 +59,6 @@ jobs:
           git add core_modules_with_last_commit.json
           git diff --cached > \
             "${OUT_DIR}/core_modules_with_last_commit.patch"
-      - name: Test create tarballs
-        run: |
-          cd ..
-          GRASS="grass-8.4.1"
-          tar -cvf "${OUT_DIR}/${GRASS}.tar" \
-            --exclude=".gi*" --exclude=".tr*" \
-            --transform s/grass/"${GRASS}"/ grass
-          cd "${OUT_DIR}" || exit
-          gzip -9k "${GRASS}.tar"
-          md5sum "${GRASS}.tar.gz" > "${GRASS}.tar.gz.md5"
-          sha256sum "${GRASS}.tar.gz" > "${GRASS}.tar.gz.sha256"
-          xz -9e "${GRASS}.tar"
-          md5sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.md5"
-          sha256sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.sha256"
       - name: Create tarballs (for tags only)
         if: startsWith(github.ref, 'refs/tags/')
         run: |

From 1dcfffa206c55fb6fdcc2d68a1f625203fd84fc0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:34:38 +0000
Subject: [PATCH 17/42] CI: Address actionlint/shellcheck and zizmor issues in
 milestones.yml workflow

---
 .github/workflows/milestones.yml | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/milestones.yml b/.github/workflows/milestones.yml
index 4e9fa634a75..1126ae72a11 100644
--- a/.github/workflows/milestones.yml
+++ b/.github/workflows/milestones.yml
@@ -22,13 +22,16 @@ jobs:
       - name: Get current milestone title
         id: current-milestone
         run: |
-          echo "milestone<<EOF" >> "${GITHUB_OUTPUT}"
-          gh pr view ${{ github.event.pull_request.html_url }} --json milestone \
-            --jq .milestone.title >> "${GITHUB_OUTPUT}"
-          echo 'EOF' >> "${GITHUB_OUTPUT}"
+          {
+            echo "milestone<<EOF"
+            gh pr view "${GITHUB_EVENT_PULL_REQUEST_HTML_URL}" --json milestone \
+              --jq .milestone.title
+            echo 'EOF'
+          } >> "${GITHUB_OUTPUT}"
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
+          GITHUB_EVENT_PULL_REQUEST_HTML_URL: ${{ github.event.pull_request.html_url }}
       - name: PR already has a milestone
         run: echo "PR already has a milestone"
         if: ${{ steps.current-milestone.outputs.milestone }}
@@ -39,12 +42,14 @@ jobs:
         if: ${{ !steps.current-milestone.outputs.milestone }}
         id: version-file
         run: |
-          echo "version<<EOF" >> "${GITHUB_OUTPUT}"
-          gh api \
-            -H "Accept: application/vnd.github.raw" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            "/repos/{owner}/{repo}/contents/include/VERSION?ref=${{ github.sha }}" >> "${GITHUB_OUTPUT}"
-          echo "EOF" >> "${GITHUB_OUTPUT}"
+          {
+            echo "version<<EOF"
+            gh api \
+              -H "Accept: application/vnd.github.raw" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              "/repos/{owner}/{repo}/contents/include/VERSION?ref=${{ github.sha }}"
+            echo "EOF"
+          } >> "${GITHUB_OUTPUT}"
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
@@ -57,8 +62,8 @@ jobs:
         if: ${{ !steps.current-milestone.outputs.milestone }}
         id: milestone
         run: |
-          version=$(echo "$VERSIONFILE" | head -n 3 | xargs | sed 's/ /./g; s/\(RC[0-9]*\|dev\)//g')
-          echo "title=$version" >> "${GITHUB_OUTPUT}"
+          version=$(echo "${VERSIONFILE}" | head -n 3 | xargs | sed 's/ /./g; s/\(RC[0-9]*\|dev\)//g')
+          echo "title=${version}" >> "${GITHUB_OUTPUT}"
         env:
           VERSIONFILE: ${{ steps.version-file.outputs.version }}
       - name: Show milestone title
@@ -68,8 +73,9 @@ jobs:
           MILESTONE: ${{ steps.milestone.outputs.title }}
       - name: Set PR milestone
         if: ${{ !steps.current-milestone.outputs.milestone }}
-        run: gh pr edit ${{ github.event.pull_request.html_url }} --milestone "${MILESTONE}"
+        run: gh pr edit "${GITHUB_EVENT_PULL_REQUEST_HTML_URL}" --milestone "${MILESTONE}"
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           MILESTONE: ${{ steps.milestone.outputs.title }}
+          GITHUB_EVENT_PULL_REQUEST_HTML_URL: ${{ github.event.pull_request.html_url }}

From 78b1e1f28f88d350d3516dc55f8a968ef9397422 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:37:24 +0000
Subject: [PATCH 18/42] CI: Ignore zizmor dangerous-triggers for milestones.yml
 workflow

To the best of my knowledge and after another review, this workflow is most appropriate to be used with pull_request_target limited to closed and merged PRs.
---
 .github/workflows/milestones.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/milestones.yml b/.github/workflows/milestones.yml
index 1126ae72a11..41831313c2b 100644
--- a/.github/workflows/milestones.yml
+++ b/.github/workflows/milestones.yml
@@ -2,7 +2,7 @@
 name: Assign Milestone
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [closed]
 
 permissions: {}

From aa938b3d27c5e38d454bdebebcaa116f2ee5e394 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:43:25 +0000
Subject: [PATCH 19/42] CI: Address actionlint/shellcheck and zizmor issues in
 verify-success.yml workflow

---
 .github/workflows/verify-success.yml | 94 +++++++++++++++-------------
 1 file changed, 50 insertions(+), 44 deletions(-)

diff --git a/.github/workflows/verify-success.yml b/.github/workflows/verify-success.yml
index 2d357f6ddce..89f1cb11a14 100644
--- a/.github/workflows/verify-success.yml
+++ b/.github/workflows/verify-success.yml
@@ -84,50 +84,44 @@ jobs:
       - name: Set outputs for each job result type
         id: has-result
         run: |
-          echo "failure=${{
-            contains(env.NEEDS_RESULT, 'failure') }}" >> "$GITHUB_OUTPUT"
-          echo "cancelled=${{
-            contains(env.NEEDS_RESULT, 'cancelled') }}" >> "$GITHUB_OUTPUT"
-          echo "skipped=${{
-            contains(env.NEEDS_RESULT, 'skipped') }}" >> "$GITHUB_OUTPUT"
-          echo "success=${{
-            contains(env.NEEDS_RESULT, 'success') }}" >> "$GITHUB_OUTPUT"
+          {
+            echo "failure=${{ contains(env.NEEDS_RESULT, 'failure') }}"
+            echo "cancelled=${{ contains(env.NEEDS_RESULT, 'cancelled') }}"
+            echo "skipped=${{ contains(env.NEEDS_RESULT, 'skipped') }}"
+            echo "success=${{ contains(env.NEEDS_RESULT, 'success') }}"
+          } >> "$GITHUB_OUTPUT"
         env:
           NEEDS_RESULT: ${{ toJson(fromJson(inputs.needs_context).*.result) }}
       - name: Set exit codes for each job result type
         id: exit-code
         run: |
-          echo "failure=${{ inputs.fail_if_failure &&
-                  fromJson(steps.has-result.outputs.failure) && 1 || 0
-                  }}" >> "$GITHUB_OUTPUT"
-          echo "cancelled=${{ inputs.fail_if_cancelled &&
-                  fromJson(steps.has-result.outputs.cancelled) && 1 || 0
-                  }}" >> "$GITHUB_OUTPUT"
-          echo "skipped=${{ inputs.fail_if_skipped &&
-                  fromJson(steps.has-result.outputs.skipped) && 1 || 0
-                  }}" >> "$GITHUB_OUTPUT"
-          echo "success=${{ inputs.require_success &&
-                  !fromJson(steps.has-result.outputs.success) && 1 || 0
-                  }}" >> "$GITHUB_OUTPUT"
+          {
+            echo "failure=${{ inputs.fail_if_failure &&
+                    fromJson(steps.has-result.outputs.failure) && 1 || 0 }}"
+            echo "cancelled=${{ inputs.fail_if_cancelled &&
+                    fromJson(steps.has-result.outputs.cancelled) && 1 || 0 }}"
+            echo "skipped=${{ inputs.fail_if_skipped &&
+                    fromJson(steps.has-result.outputs.skipped) && 1 || 0 }}"
+            echo "success=${{ inputs.require_success &&
+                    !fromJson(steps.has-result.outputs.success) && 1 || 0 }}"
+          } >> "$GITHUB_OUTPUT"
       - name: Set messages for each job result type
         id: message
         run: |
-          echo "failure=${{ format('{0}{1} were failed',
-            (steps.exit-code.outputs.failure == 1) && env.P1 || env.P2,
-            (steps.has-result.outputs.failure == 'true') && env.M1 || env.M2)
-            }}" >> "$GITHUB_OUTPUT"
-          echo "cancelled=${{ format('{0}{1} were cancelled',
-            (steps.exit-code.outputs.cancelled == 1) && env.P1 || env.P2,
-            (steps.has-result.outputs.cancelled == 'true') && env.M1 || env.M2)
-            }}" >> "$GITHUB_OUTPUT"
-          echo "skipped=${{ format('{0}{1} were skipped',
-            (steps.exit-code.outputs.skipped == 1) && env.P1 || env.P2,
-            (steps.has-result.outputs.skipped == 'true') && env.M1 || env.M2)
-            }}" >> "$GITHUB_OUTPUT"
-          echo "success=${{ format('{0}{1} were successful',
-            (steps.exit-code.outputs.success == 1) && env.P1 || env.P2,
-            (steps.has-result.outputs.success == 'true') && env.M1 || env.M2)
-            }}" >> "$GITHUB_OUTPUT"
+          {
+            echo "failure=${{ format('{0}{1} were failed',
+              (steps.exit-code.outputs.failure == 1) && env.P1 || env.P2,
+              (steps.has-result.outputs.failure == 'true') && env.M1 || env.M2)}}"
+            echo "cancelled=${{ format('{0}{1} were cancelled',
+              (steps.exit-code.outputs.cancelled == 1) && env.P1 || env.P2,
+              (steps.has-result.outputs.cancelled == 'true') && env.M1 || env.M2)}}"
+            echo "skipped=${{ format('{0}{1} were skipped',
+              (steps.exit-code.outputs.skipped == 1) && env.P1 || env.P2,
+              (steps.has-result.outputs.skipped == 'true') && env.M1 || env.M2)}}"
+            echo "success=${{ format('{0}{1} were successful',
+              (steps.exit-code.outputs.success == 1) && env.P1 || env.P2,
+              (steps.has-result.outputs.success == 'true') && env.M1 || env.M2)}}"
+          } >> "$GITHUB_OUTPUT"
         env:
           P1: "::error ::" # Common message prefix if step will fail
           P2: "" # Common message prefix if step will not fail
@@ -136,20 +130,32 @@ jobs:
 
       - name: Check for failed jobs
         run: |
-          echo "${{ steps.message.outputs.failure }}"
-          exit ${{ steps.exit-code.outputs.failure }}
+          echo "${STEPS_MESSAGE_OUTPUTS_FAILURE}"
+          exit "${STEPS_EXIT_CODE_OUTPUTS_FAILURE}"
+        env:
+          STEPS_MESSAGE_OUTPUTS_FAILURE: ${{ steps.message.outputs.failure }}
+          STEPS_EXIT_CODE_OUTPUTS_FAILURE: ${{ steps.exit-code.outputs.failure }}
       - name: Check for cancelled jobs
         run: |
-          echo "${{ steps.message.outputs.cancelled }}"
-          exit ${{ steps.exit-code.outputs.cancelled }}
+          echo "${STEPS_MESSAGE_OUTPUTS_CANCELLED}"
+          exit "${STEPS_EXIT_CODE_OUTPUTS_CANCELLED}"
+        env:
+          STEPS_MESSAGE_OUTPUTS_CANCELLED: ${{ steps.message.outputs.cancelled }}
+          STEPS_EXIT_CODE_OUTPUTS_CANCELLED: ${{ steps.exit-code.outputs.cancelled }}
       - name: Check for skipped jobs
         run: |
-          echo "${{ steps.message.outputs.skipped }}"
-          exit ${{ steps.exit-code.outputs.skipped }}
+          echo "${STEPS_MESSAGE_OUTPUTS_SKIPPED}"
+          exit "${STEPS_EXIT_CODE_OUTPUTS_SKIPPED}"
+        env:
+          STEPS_MESSAGE_OUTPUTS_SKIPPED: ${{ steps.message.outputs.skipped }}
+          STEPS_EXIT_CODE_OUTPUTS_SKIPPED: ${{ steps.exit-code.outputs.skipped }}
       - name: Check for successful jobs
         run: |
-          echo "${{ steps.message.outputs.success }}"
-          exit ${{ steps.exit-code.outputs.success }}
+          echo "${STEPS_MESSAGE_OUTPUTS_SUCCESS}"
+          exit "${STEPS_EXIT_CODE_OUTPUTS_SUCCESS}"
+        env:
+          STEPS_MESSAGE_OUTPUTS_SUCCESS: ${{ steps.message.outputs.success }}
+          STEPS_EXIT_CODE_OUTPUTS_SUCCESS: ${{ steps.exit-code.outputs.success }}
 
       - run: echo "Checks passed successfully"
         if: ${{ success() }}

From a47a2e40ee2712df2069b73b82b0f3115c9b355a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:57:03 +0000
Subject: [PATCH 20/42] CI: Address actionlint/shellcheck and zizmor issues in
 macos_distribute_app.yml workflow

---
 .github/workflows/macos_distribute_app.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos_distribute_app.yml b/.github/workflows/macos_distribute_app.yml
index 275ed61a572..c309029ba8e 100644
--- a/.github/workflows/macos_distribute_app.yml
+++ b/.github/workflows/macos_distribute_app.yml
@@ -111,15 +111,15 @@ jobs:
       - name: Create config file
         shell: bash -el {0}
         env:
-          Config: ${HOME}/.config/grass/configure-build-${{ matrix.name }}.sh
+          CONFIG: ${HOME}/.config/grass/configure-build-${{ matrix.name }}.sh
           MACOS_CERTIFICATE_NAME: ${{ secrets.MACOS_CERTIFICATE_NAME }}
         run: |
           mkdir -p "${HOME}/.config/grass"
-          echo sdk=\"$(xcrun --show-sdk-path)\" >> ${{ env.Config }}
-          echo deployment_target=\"${{ matrix.deployment_target }}\" >> ${{ env.Config }}
-          echo cs_ident=\"${MACOS_CERTIFICATE_NAME}\" >> ${{ env.Config }}
-          echo cs_keychain_profile=\"${KEYCHAIN_PROFILE}\" >> ${{ env.Config }}
-          echo cs_provisionprofile=\"${RUNNER_TEMP}/embedded.provisionprofile\" >> ${{ env.Config }}
+          echo sdk=\"$(xcrun --show-sdk-path)\" >> "${CONFIG}"
+          echo deployment_target=\"${{ matrix.deployment_target }}\" >> "${CONFIG}"
+          echo cs_ident=\"${MACOS_CERTIFICATE_NAME}\" >> "${CONFIG}"
+          echo cs_keychain_profile=\"${KEYCHAIN_PROFILE}\" >> "${CONFIG}"
+          echo cs_provisionprofile=\"${RUNNER_TEMP}/embedded.provisionprofile\" >> "${CONFIG}"
 
       - name: Build GRASS app
         run: |

From 655e1f052960fadd985ee4d1df2fd19aa5719321 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:59:14 +0000
Subject: [PATCH 21/42] CI: Fix shellcheck SC2129 in macos_distribute_app.yml
 workflow

---
 .github/workflows/macos_distribute_app.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/macos_distribute_app.yml b/.github/workflows/macos_distribute_app.yml
index c309029ba8e..dec0a128659 100644
--- a/.github/workflows/macos_distribute_app.yml
+++ b/.github/workflows/macos_distribute_app.yml
@@ -115,11 +115,13 @@ jobs:
           MACOS_CERTIFICATE_NAME: ${{ secrets.MACOS_CERTIFICATE_NAME }}
         run: |
           mkdir -p "${HOME}/.config/grass"
-          echo sdk=\"$(xcrun --show-sdk-path)\" >> "${CONFIG}"
-          echo deployment_target=\"${{ matrix.deployment_target }}\" >> "${CONFIG}"
-          echo cs_ident=\"${MACOS_CERTIFICATE_NAME}\" >> "${CONFIG}"
-          echo cs_keychain_profile=\"${KEYCHAIN_PROFILE}\" >> "${CONFIG}"
-          echo cs_provisionprofile=\"${RUNNER_TEMP}/embedded.provisionprofile\" >> "${CONFIG}"
+          {
+            echo sdk=\"$(xcrun --show-sdk-path)\"
+            echo deployment_target=\"${{ matrix.deployment_target }}\"
+            echo cs_ident=\"${MACOS_CERTIFICATE_NAME}\"
+            echo cs_keychain_profile=\"${KEYCHAIN_PROFILE}\"
+            echo cs_provisionprofile=\"${RUNNER_TEMP}/embedded.provisionprofile\"
+          } >> "${CONFIG}"
 
       - name: Build GRASS app
         run: |

From e3e5da69bf2c960186cdfbcf3be519ac145ec983 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 22:08:48 +0000
Subject: [PATCH 22/42] CI: Address actionlint/shellcheck and zizmor issues in
 macos_distribute_app.yml workflow

---
 .github/workflows/macos_distribute_app.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos_distribute_app.yml b/.github/workflows/macos_distribute_app.yml
index dec0a128659..c0adc7632ce 100644
--- a/.github/workflows/macos_distribute_app.yml
+++ b/.github/workflows/macos_distribute_app.yml
@@ -113,19 +113,20 @@ jobs:
         env:
           CONFIG: ${HOME}/.config/grass/configure-build-${{ matrix.name }}.sh
           MACOS_CERTIFICATE_NAME: ${{ secrets.MACOS_CERTIFICATE_NAME }}
+          MATRIX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target }}
         run: |
           mkdir -p "${HOME}/.config/grass"
           {
-            echo sdk=\"$(xcrun --show-sdk-path)\"
-            echo deployment_target=\"${{ matrix.deployment_target }}\"
-            echo cs_ident=\"${MACOS_CERTIFICATE_NAME}\"
-            echo cs_keychain_profile=\"${KEYCHAIN_PROFILE}\"
-            echo cs_provisionprofile=\"${RUNNER_TEMP}/embedded.provisionprofile\"
+            echo sdk=\""$(xcrun --show-sdk-path)"\"
+            echo deployment_target=\""${MATRIX_DEPLOYMENT_TARGET}"\"
+            echo cs_ident=\""${MACOS_CERTIFICATE_NAME}"\"
+            echo cs_keychain_profile=\""${KEYCHAIN_PROFILE}"\"
+            echo cs_provisionprofile=\""${RUNNER_TEMP}/embedded.provisionprofile"\"
           } >> "${CONFIG}"
 
       - name: Build GRASS app
         run: |
-          ./macos/build_grass_app.bash --with-liblas --notarize -o "${{ runner.temp }}"
+          ./macos/build_grass_app.bash --with-liblas --notarize -o "${RUNNER_TEMP}"
 
       - name: Upload DMG file as artifact
         if: ${{ success() && !cancelled() }}

From d210555da4fb772e169f7ede6b0e88f9678c9de5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:03:21 +0000
Subject: [PATCH 23/42] CI(docs): Fix ccache key using invalid python-version
 from matrix, use env var instead

---
 .github/workflows/documentation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 03141e96954..fd04f3658e7 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -75,7 +75,7 @@ jobs:
           create-symlink: true
           verbose: 2
           evict-old-files: 7d
-          key: ${{ github.workflow }}-${{ github.job }}-grass${{ env.MAJOR }}-${{ matrix.python-version }}
+          key: ${{ github.workflow }}-${{ github.job }}-grass${{ env.MAJOR }}-${{ env.PYTHON_VERSION }}
 
       - name: Install Python dependencies
         # We install both core and addon dependencies, but we don't install any

From ab8abad725d088909648660214f024207008756a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:06:55 +0000
Subject: [PATCH 24/42] CI: Address actionlint/shellcheck and zizmor issues in
 documentation.yml workflow

Two ShellCheck issues should be fixed later on regarding the use of ls in a for loop.
---
 .github/workflows/documentation.yml | 63 ++++++++++++++++-------------
 1 file changed, 34 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index fd04f3658e7..21e1d22be3b 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -53,12 +53,14 @@ jobs:
 
       - name: Set version variables
         run: |
-          cd grass
-          eval $(./utils/update_version.py status --bash)
-          echo "MAJOR=$MAJOR" >> $GITHUB_ENV
-          echo "MINOR=$MINOR" >> $GITHUB_ENV
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-          echo "YEAR=$YEAR" >> $GITHUB_ENV
+          cd grass || exit
+          eval "$(./utils/update_version.py status --bash)"
+          {
+            echo "MAJOR=${MAJOR}"
+            echo "MINOR=${MINOR}"
+            echo "VERSION=${VERSION}"
+            echo "YEAR=${YEAR}"
+          } >> "${GITHUB_ENV}"
 
       - name: Checkout addons
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -170,11 +172,11 @@ jobs:
       - name: Compile addons
         run: |
           ./grass-addons/utils/cronjobs_osgeo_lxd/compile_addons_git.sh \
-            "$MAJOR" \
-            "$MINOR" \
-            $(pwd)/grass-addons/src \
-            $(grass --config path) \
-            $(pwd)/addons-build-dir \
+            "${MAJOR}" \
+            "${MINOR}" \
+            "$(pwd)/grass-addons/src" \
+            "$(grass --config path)" \
+            "$(pwd)/addons-build-dir" \
             grass
 
       - name: Get target path for Markdown files
@@ -183,24 +185,27 @@ jobs:
 
       - name: Move from build to target directory
         run: |
-          mkdir "$MKDOCS_DIR/source/addons"
-          mv -v addons-build-dir/docs/md/source/* "$MKDOCS_DIR/source/addons"
+          mkdir "${MKDOCS_DIR}/source/addons"
+          mv -v addons-build-dir/docs/md/source/* "${MKDOCS_DIR}/source/addons"
 
       - name: Build index
         run: |
-          export ARCH="$(grass --config arch)"
-          export ARCH_DISTDIR="$(grass --config path)"
-          export VERSION_NUMBER="$VERSION"
+          ARCH="$(grass --config arch)"
+          ARCH_DISTDIR="$(grass --config path)"
+          export ARCH
+          export ARCH_DISTDIR
+          export VERSION_NUMBER="${VERSION}"
           grass --tmp-project XY --exec \
-            python grass/man/build_full_index.py md index "$MKDOCS_DIR/source/addons" addons
+            python grass/man/build_full_index.py md index "${MKDOCS_DIR}/source/addons" addons
 
       - name: Copy shared files to addons
         run: |
-          cd "$MKDOCS_DIR/source"
+          cd "${MKDOCS_DIR}/source" || exit
           # This should match directories with color tables and other files
           # linked from the pages.
+          # shellcheck disable=SC2010,SC2035 # TODO: Address these two issues
           for name in $(ls -1d */ | grep -vE "^(addons|libpython)/$"); do
-            cp -rv $name addons
+            cp -rv "${name}" addons
           done
 
       - name: Get mkdocs
@@ -209,30 +214,30 @@ jobs:
 
       - name: Run mkdocs
         run: |
-          cd grass
-          eval $(./utils/update_version.py status --bash)
+          cd grass || exit
+          eval "$(./utils/update_version.py status --bash)"
           cd ..
           export SITE_NAME="GRASS $VERSION Documentation"
           export COPYRIGHT="&copy; 2003-$YEAR GRASS Development Team, GRASS $VERSION Documentation"
-          cd $MKDOCS_DIR
+          cd "${MKDOCS_DIR}" || exit
           mkdocs build
 
       - name: Build Sphinx documentation
         run: |
           pip install -r "grass/python/grass/docs/requirements.txt"
-          cd grass
+          cd grass || exit
           make sphinxdoclib
           ARCH="$(grass --config arch)"
-          mv -v dist.$ARCH/docs/html/libpython $MKDOCS_DIR/site
+          mv -v dist."${ARCH}/docs/html/libpython" "${MKDOCS_DIR}/site"
 
       - name: Merge Sphinx and MkDocs Sitemaps
         run: |
-          cd grass
+          cd grass || exit
           python utils/merge_sitemaps.py \
-            --mkdocs-sitemap "$MKDOCS_DIR/site/sitemap.xml" \
-            --sphinx-sitemap "$MKDOCS_DIR/site/libpython/sitemap.xml" \
-            --output "$MKDOCS_DIR/site/sitemap.xml" \
-            --version $VERSION -o
+            --mkdocs-sitemap "${MKDOCS_DIR}/site/sitemap.xml" \
+            --sphinx-sitemap "${MKDOCS_DIR}/site/libpython/sitemap.xml" \
+            --output "${MKDOCS_DIR}/site/sitemap.xml" \
+            --version "${VERSION}" -o
 
       - name: Make logs available
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

From 7e9cc9b0a03f01f6fb4daad3cfa44f301a9b8564 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:12:11 +0000
Subject: [PATCH 25/42] CI: Do not use cache with workflow_dispatch in
 documentation.yml workflow

Fixes a cache-poisoning issue reported by zizmor

Two separate steps are used. It is assuming that the push event is not used for tags and that these artifacts (using cache) are not published as release artifacts
---
 .github/workflows/documentation.yml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 21e1d22be3b..ae0188918da 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -45,11 +45,18 @@ jobs:
           xargs -a <(awk '! /^ *(#|$)/' "grass/.github/workflows/apt.txt") -r -- \
               sudo apt-get install -y --no-install-recommends --no-install-suggests
 
-      - name: Set up Python
+      - name: Set up Python (with cache)
+        if: ${{ contains(fromJSON('["push", "pull_request"]'), github.event_name) }}
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: pip # zizmor: ignore[cache-poisoning] Assuming push event is not used for tags
+
+      - name: Set up Python (no cache, use for release artifacts)
+        if: ${{ !contains(fromJSON('["push", "pull_request"]'), github.event_name) }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
-          cache: pip
 
       - name: Set version variables
         run: |
@@ -71,8 +78,9 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: ccache
+      - name: ccache (do not use for release artifacts)
         uses: hendrikmuhs/ccache-action@63069e3931dedbf3b63792097479563182fe70d1 # v1.2.18
+        if: ${{ !contains(fromJSON('["push", "pull_request"]'), github.event_name) }}
         with:
           create-symlink: true
           verbose: 2
@@ -88,6 +96,7 @@ jobs:
           pip install -r grass-addons/.github/workflows/requirements.txt
 
       - uses: rui314/setup-mold@725a8794d15fc7563f59595bd9556495c0564878 # v1
+        if: ${{ !contains(fromJSON('["push", "pull_request"]'), github.event_name) }}
 
       - name: Create installation directory
         run: |

From 9d6a6b0f70cec073789663326d03e212017a5135 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:14:16 +0000
Subject: [PATCH 26/42] CI: Address actionlint/shellcheck and zizmor issues in
 gcc.yml workflow

---
 .github/workflows/gcc.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/gcc.yml b/.github/workflows/gcc.yml
index 1db67a21ca8..78116f60264 100644
--- a/.github/workflows/gcc.yml
+++ b/.github/workflows/gcc.yml
@@ -40,13 +40,13 @@ jobs:
               sudo apt-get install -y --no-install-recommends --no-install-suggests
       - name: Create installation directory
         run: |
-          mkdir $HOME/install
+          mkdir "${HOME}/install"
       - name: Ensure one core for compilation
         run: |
-          echo "MAKEFLAGS=-j1" >> $GITHUB_ENV
+          echo "MAKEFLAGS=-j1" >> "${GITHUB_ENV}"
       - name: Set LD_LIBRARY_PATH for compilation
         run: |
-          echo "LD_LIBRARY_PATH=$HOME/install/lib" >> $GITHUB_ENV
+          echo "LD_LIBRARY_PATH=${HOME}/install/lib" >> "${GITHUB_ENV}"
       - name: Print build environment variables
         shell: bash -el {0}
         run: |
@@ -60,5 +60,5 @@ jobs:
           # TODO: -pedantic-errors here won't compile
           CXXFLAGS: -std=${{ matrix.cpp }} -fPIC -Wall -Wextra
         run: |
-          .github/workflows/build_ubuntu-22.04.sh $HOME/install \
+          .github/workflows/build_ubuntu-22.04.sh "${HOME}/install" \
               -isystem/usr/include/gdal -Wpedantic -Werror

From 933cd2b4fbdfc439d5147a8bf73c0c9c012e1c36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:16:41 +0000
Subject: [PATCH 27/42] CI: Address actionlint/shellcheck and zizmor issues in
 periodic_update.yml workflow

---
 .github/workflows/periodic_update.yml | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/periodic_update.yml b/.github/workflows/periodic_update.yml
index 59cc17b0079..5f0e4f6f125 100644
--- a/.github/workflows/periodic_update.yml
+++ b/.github/workflows/periodic_update.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: Create URL to the run output
         id: vars
-        run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> $GITHUB_OUTPUT
+        run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/${GITHUB_RUN_ID}" >> "${GITHUB_OUTPUT}"
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
@@ -60,8 +60,11 @@ jobs:
       - name: Check outputs
         if: ${{ steps.cpr.outputs.pull-request-number }}
         run: |
-          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
-          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"
+          echo "Pull Request Number - ${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
+          echo "Pull Request URL - ${STEPS_CPR_OUTPUTS_PULL_REQUEST_URL}"
+        env:
+          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
+          STEPS_CPR_OUTPUTS_PULL_REQUEST_URL: ${{ steps.cpr.outputs.pull-request-url }}
   update-i18n:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
@@ -74,7 +77,7 @@ jobs:
     steps:
       - name: Create URL to the run output
         id: vars
-        run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> $GITHUB_OUTPUT
+        run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/${GITHUB_RUN_ID}" >> "${GITHUB_OUTPUT}"
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
@@ -95,7 +98,7 @@ jobs:
             --without-opengl \
             --without-pdal
       - name: Build grass core
-        run: make -j$(nproc)
+        run: make -j"$(nproc)"
       - name: Create .pot files (containing original messages)
         run: cd locale && make pot
       - name: Merge new messages (Done by Weblate plugin)
@@ -133,12 +136,16 @@ jobs:
           branch: periodic/update-i18n
           title: "locale: Update translation files"
           body: |
-            This updates the .pot template files, as well as all language-specific .po files.
+            This updates the .pot template files, as well as all language-specific .po files
+            if the option was selected.
             [Workflow run summary](${{ steps.vars.outputs.run-url }})
 
             Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action
       - name: Check outputs
         if: ${{ steps.changed-files.outcome == 'failure' && steps.cpr.outputs.pull-request-number }}
         run: |
-          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
-          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"
+          echo "Pull Request Number - ${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
+          echo "Pull Request URL - ${STEPS_CPR_OUTPUTS_PULL_REQUEST_URL}"
+        env:
+          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
+          STEPS_CPR_OUTPUTS_PULL_REQUEST_URL: ${{ steps.cpr.outputs.pull-request-url }}

From 08ea0410ef87942347cb21da66e3eece4154e8e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:30:47 +0000
Subject: [PATCH 28/42] CI: Disable caching in additional_checks if potentially
 affected on releases

---
 .github/workflows/additional_checks.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/additional_checks.yml b/.github/workflows/additional_checks.yml
index dc339ac755b..645059b8b22 100644
--- a/.github/workflows/additional_checks.yml
+++ b/.github/workflows/additional_checks.yml
@@ -39,6 +39,10 @@ jobs:
           python-version: "3.13"
       - name: Install uv and restore its cache
         uses: astral-sh/setup-uv@4959332f0f014c5280e7eac8b70c90cb574c9f9b # v6.6.0
+        with:
+          # To not have the last commit JSON and release notes files affected on
+          # releases, if copying the contents displayed in the CI logs.
+          enable-cache: false
 
       - name: Check that files with the same content are the same
         run: |
@@ -62,7 +66,8 @@ jobs:
               "$(git rev-parse HEAD~30)" \
               ""
       - name: "Cache pre-commit"
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        # Not used for releases, only for running pre-commit
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4  # zizmor: ignore[cache-poisoning]
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}

From 9822e1b43ac5e687295ad257c1785db89a2c4f66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:47:05 +0000
Subject: [PATCH 29/42] CI: Save and restore cached sample dataset to avoid
 some cases of potential cache-poisoning

---
 .github/workflows/macos.yml  | 10 +++++++++-
 .github/workflows/ubuntu.yml | 10 +++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index c11172c35d5..76d3ef82fcc 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -137,11 +137,12 @@ jobs:
 
       - name: Cache GRASS Sample Dataset
         id: cached-data
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: sample-data/nc_spm_full_v2alpha2.tar.gz
           key: nc_spm_full_v2alpha2.tar.gz
           enableCrossOsArchive: true
+          lookup-only: true
 
       - name: Download GRASS Sample Dataset
         if: steps.cached-data.outputs.cache-hit != 'true'
@@ -152,6 +153,13 @@ jobs:
           SAMPLE_DATA: "https://grass.osgeo.org/sampledata/north_carolina/\
             nc_spm_full_v2alpha2.tar.gz"
 
+      - name: Save GRASS Sample Dataset to cache
+        uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        if: steps.cached-data.outputs.cache-hit != 'true'
+        with:
+          path: sample-data/nc_spm_full_v2alpha2.tar.gz
+          key: nc_spm_full_v2alpha2.tar.gz
+
       - name: Run gunittest tests
         shell: micromamba-shell {0}
         run: .github/workflows/test_thorough.sh --config .github/workflows/macos_gunittest.cfg
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index cc57781f025..e853d5f2c38 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -151,11 +151,12 @@ jobs:
 
       - name: Cache GRASS Sample Dataset
         id: cached-data
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: sample-data/nc_spm_full_v2alpha2.tar.gz
           key: nc_spm_full_v2alpha2.tar.gz
           enableCrossOsArchive: true
+          lookup-only: true
 
       - name: Download GRASS Sample Dataset
         if: steps.cached-data.outputs.cache-hit != 'true'
@@ -166,6 +167,13 @@ jobs:
           SAMPLE_DATA: "https://grass.osgeo.org/sampledata/north_carolina/\
             nc_spm_full_v2alpha2.tar.gz"
 
+      - name: Save GRASS Sample Dataset to cache
+        uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        if: steps.cached-data.outputs.cache-hit != 'true'
+        with:
+          path: sample-data/nc_spm_full_v2alpha2.tar.gz
+          key: nc_spm_full_v2alpha2.tar.gz
+
       - name: Run tests
         run: .github/workflows/test_thorough.sh --config .gunittest.extra.cfg
         env:

From c9c2d2fe08db2c14c1b54ed1b98df601f9c83d2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:48:16 +0000
Subject: [PATCH 30/42] CI(ubuntu): Use matrix.config through an env var to
 avoid potential template injection

---
 .github/workflows/ubuntu.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index e853d5f2c38..d9f068f7e57 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -136,7 +136,9 @@ jobs:
           CFLAGS: -fPIC -Wvla -ffp-contract=off
           # TODO: -pedantic-errors here won't compile
           CXXFLAGS: -fPIC -ffp-contract=off
-        run: .github/workflows/build_${{ matrix.config }}.sh "${HOME}/install" -Werror
+          MATRIX_CONFIG: ${{ matrix.config }}
+        run: |
+          ".github/workflows/build_${MATRIX_CONFIG}.sh" "${HOME}/install" -Werror
 
       - name: Add the bin directory to PATH
         run: |

From 099ee24f74e4b5ee3c7f323a8ea07b3e6280d9a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Sun, 31 Aug 2025 23:55:25 +0000
Subject: [PATCH 31/42] CI: Address actionlint/shellcheck and zizmor issues in
 python-code-quality.yml workflow

---
 .github/workflows/python-code-quality.yml | 47 ++++++++++++++---------
 1 file changed, 29 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/python-code-quality.yml b/.github/workflows/python-code-quality.yml
index 64e68f3aab2..8c301fc8d65 100644
--- a/.github/workflows/python-code-quality.yml
+++ b/.github/workflows/python-code-quality.yml
@@ -112,11 +112,11 @@ jobs:
 
       - name: Run Flake8
         run: |
-          flake8 --count --statistics --show-source --jobs=$(nproc) .
+          flake8 --count --statistics --show-source --jobs="$(nproc)" .
 
       - name: Run Flake8 on additional files
         run: |
-          flake8 --count --statistics --show-source --jobs=$(nproc) python/grass/{script,jupyter}/testsuite/
+          flake8 --count --statistics --show-source --jobs="$(nproc)" python/grass/{script,jupyter}/testsuite/
 
       - name: Bandit Vulnerability Scan
         run: |
@@ -135,27 +135,32 @@ jobs:
 
       - name: Create installation directory
         run: |
-          mkdir $HOME/install
+          mkdir "${HOME}/install"
 
       - name: Set number of cores for compilation
         run: |
-          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
+          echo "MAKEFLAGS=-j$(nproc)" >> "${GITHUB_ENV}"
 
       - uses: rui314/setup-mold@725a8794d15fc7563f59595bd9556495c0564878 # v1
       - name: Build
-        run: .github/workflows/build_${{ matrix.os }}.sh $HOME/install
+        run: |
+          ".github/workflows/build_${MATRIX_OS}.sh" "${HOME}/install"
+        env:
+          MATRIX_OS: ${{ matrix.os }}
 
       - name: Add the bin directory to PATH
         run: |
-          echo "$HOME/install/bin" >> $GITHUB_PATH
+          echo "${HOME}/install/bin" >> "${GITHUB_PATH}"
 
       - name: Run Pylint on grass package
         # Until slower checks (like similarity) are reenabled, running in one step is faster
         if: false
         run: |
-          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
-          pylint --persistent=no --py-version=${{ env.MIN_PYTHON_VERSION }} --jobs=$(nproc) grass
+          PYTHONPATH="$(grass --config python_path):$PYTHONPATH"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:$LD_LIBRARY_PATH"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
+          pylint --persistent=no --py-version=${{ env.MIN_PYTHON_VERSION }} --jobs="$(nproc)" grass
 
       - name: Run Pylint on other files using pytest
         # Until slower checks (like similarity) are reenabled, running in one step is faster
@@ -163,9 +168,11 @@ jobs:
         run: |
           pipx inject --include-apps pylint pytest
           pipx inject pylint pytest-pylint pytest-github-actions-annotate-failures pytest-timeout
-          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
-          pytest --pylint -m pylint --pylint-jobs=$(nproc) \
+          PYTHONPATH="$(grass --config python_path):$PYTHONPATH"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:$LD_LIBRARY_PATH"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
+          pytest --pylint -m pylint --pylint-jobs="$(nproc)" \
             --pylint-ignore-patterns="${{ env.PylintIgnore }}"
         env:
           PylintIgnore: "python/.*,gui/.*"
@@ -174,15 +181,19 @@ jobs:
         # Until slower checks (like similarity) are reenabled, running in one step is faster
         if: false
         run: |
-          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
-          pylint --persistent=no --py-version=${{ env.MIN_PYTHON_VERSION }} --jobs=$(nproc) gui
+          PYTHONPATH="$(grass --config python_path):$PYTHONPATH"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:$LD_LIBRARY_PATH"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
+          pylint --persistent=no --py-version="${MIN_PYTHON_VERSION}" --jobs="$(nproc)" gui
 
       - name: Run Pylint all in one pass
         run: |
-          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
-          pylint --persistent=no --py-version=${{ env.MIN_PYTHON_VERSION }} --jobs=$(nproc) .
+          PYTHONPATH="$(grass --config python_path):$PYTHONPATH"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:$LD_LIBRARY_PATH"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
+          pylint --persistent=no --py-version="${MIN_PYTHON_VERSION}" --jobs="$(nproc)" .
 
       - name: Test compiling example modules
         run: |

From 7edb6746204980d38802f24c1cbc1f71099f0ea2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:06:22 +0000
Subject: [PATCH 32/42] CI: Address zizmor issues in titles.yml workflow

---
 .github/workflows/titles.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/titles.yml b/.github/workflows/titles.yml
index af815dffac6..6482e04cca6 100644
--- a/.github/workflows/titles.yml
+++ b/.github/workflows/titles.yml
@@ -2,7 +2,10 @@
 name: Validate Titles
 
 on:
+  # zizmor: ignore[dangerous-triggers] Limits to maintained main branch, and avoids running PR code
   pull_request_target:
+    branches:
+      - main
     types:
       - edited
       # The following types are default for pull_request_target

From a162dd804b2409e7ac78107781529ffe06b95229 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:11:08 +0000
Subject: [PATCH 33/42] CI: Re-allow downloading cached sample dataset

---
 .github/workflows/macos.yml  | 1 -
 .github/workflows/ubuntu.yml | 1 -
 2 files changed, 2 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 76d3ef82fcc..63f0733b562 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -142,7 +142,6 @@ jobs:
           path: sample-data/nc_spm_full_v2alpha2.tar.gz
           key: nc_spm_full_v2alpha2.tar.gz
           enableCrossOsArchive: true
-          lookup-only: true
 
       - name: Download GRASS Sample Dataset
         if: steps.cached-data.outputs.cache-hit != 'true'
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index d9f068f7e57..3e0163d09ba 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -158,7 +158,6 @@ jobs:
           path: sample-data/nc_spm_full_v2alpha2.tar.gz
           key: nc_spm_full_v2alpha2.tar.gz
           enableCrossOsArchive: true
-          lookup-only: true
 
       - name: Download GRASS Sample Dataset
         if: steps.cached-data.outputs.cache-hit != 'true'

From 811db2da6f04b8198ea0d222433d1cfdc2f054c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:13:33 +0000
Subject: [PATCH 34/42] CI: Address zizmor issues in label.yml workflow

---
 .github/workflows/label.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index 74740d28d8a..943974c67e4 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -9,7 +9,12 @@ name: Pull Request Labeler
 # https://github.com/actions/labeler/blob/master/README.md
 
 on:
-  - pull_request_target
+  # zizmor: ignore[dangerous-triggers] Labeler should be used with pull_request_target
+  pull_request_target:
+    # Limit pull_request_target execution to maintained branches
+    branches:
+      - main
+      - releasebranch_*
 
 permissions: {}
 

From 08bff47b7c4179fa79728b6722af08a43b718647 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:17:10 +0000
Subject: [PATCH 35/42] CI: Address zizmor issue in post-pr-reviews.yml
 workflow

---
 .github/workflows/post-pr-reviews.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/post-pr-reviews.yml b/.github/workflows/post-pr-reviews.yml
index 0472d1b5b6f..2fd971f8488 100644
--- a/.github/workflows/post-pr-reviews.yml
+++ b/.github/workflows/post-pr-reviews.yml
@@ -2,6 +2,7 @@
 name: Post PR code suggestions
 
 on:
+  # zizmor: ignore[dangerous-triggers] Only selected workflows, and whitelisted input values are used
   workflow_run:
     workflows: ["ClangFormat Check", "Python Code Quality"]
     types:

From 31e3d736fa7bf9f27387795d25c5307d5ef54940 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:24:32 +0000
Subject: [PATCH 36/42] CI: Address actionlint/shellcheck issues in pytest.yml
 workflow

---
 .github/workflows/pytest.yml | 59 ++++++++++++++++++++++++------------
 1 file changed, 39 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 0af25e9d5b7..e9e7d81ba39 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -63,18 +63,21 @@ jobs:
 
       - name: Create installation directory
         run: |
-          mkdir $HOME/install
+          mkdir "${HOME}/install"
 
       - name: Set number of cores for compilation
         run: |
-          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
+          echo "MAKEFLAGS=-j$(nproc)" >> "${GITHUB_ENV}"
 
       - name: Build
-        run: .github/workflows/build_${{ matrix.os }}.sh $HOME/install
+        run: |
+          ".github/workflows/build_${MATRIX_OS}.sh" "${HOME}/install"
+        env:
+          MATRIX_OS: ${{ matrix.os }}
 
       - name: Add the bin directory to PATH
         run: |
-          echo "$HOME/install/bin" >> $GITHUB_PATH
+          echo "${HOME}/install/bin" >> "${GITHUB_PATH}"
 
       - name: Print installed versions
         if: always()
@@ -85,10 +88,14 @@ jobs:
 
       - name: Run pytest with multiple workers in parallel
         run: |
-          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
-          export INITIAL_GISBASE="$(grass --config path)"
-          export INITIAL_PWD="${PWD}"
+          PYTHONPATH="$(grass --config python_path):${PYTHONPATH}"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:${LD_LIBRARY_PATH}"
+          INITIAL_GISBASE="$(grass --config path)"
+          INITIAL_PWD="${PWD}"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
+          export INITIAL_GISBASE
+          export INITIAL_PWD
           pytest \
             @.github/workflows/pytest_args_ci.txt \
             @.github/workflows/pytest_args_cov.txt \
@@ -98,10 +105,14 @@ jobs:
 
       - name: Run pytest with a single worker (for tests marked with needs_solo_run)
         run: |
-          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
-          export INITIAL_GISBASE="$(grass --config path)"
-          export INITIAL_PWD="${PWD}"
+          PYTHONPATH="$(grass --config python_path):${PYTHONPATH}"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:${LD_LIBRARY_PATH}"
+          INITIAL_GISBASE="$(grass --config path)"
+          INITIAL_PWD="${PWD}"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
+          export INITIAL_GISBASE
+          export INITIAL_PWD
           pytest \
             @.github/workflows/pytest_args_ci.txt \
             @.github/workflows/pytest_args_cov.txt \
@@ -110,20 +121,28 @@ jobs:
             -k 'not testsuite'
       - name: Run pytest with a single worker (for gunittest-based tests)
         run: |
-          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
-          export INITIAL_GISBASE="$(grass --config path)"
-          export INITIAL_PWD="${PWD}"
+          PYTHONPATH="$(grass --config python_path):${PYTHONPATH}"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:${LD_LIBRARY_PATH}"
+          INITIAL_GISBASE="$(grass --config path)"
+          INITIAL_PWD="${PWD}"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
+          export INITIAL_GISBASE
+          export INITIAL_PWD
           pytest \
             @.github/workflows/pytest_args_cov.txt \
             @.github/workflows/pytest_args_gunittest.txt \
             --junitxml=pytest.gunittest.junit.xml
       - name: Fix non-standard installed script paths in coverage data
         run: |
-          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
-          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
-          export INITIAL_GISBASE="$(grass --config path)"
-          export INITIAL_PWD="${PWD}"
+          PYTHONPATH="$(grass --config python_path):${PYTHONPATH}"
+          LD_LIBRARY_PATH="$(grass --config path)/lib:${LD_LIBRARY_PATH}"
+          INITIAL_GISBASE="$(grass --config path)"
+          INITIAL_PWD="${PWD}"
+          export PYTHONPATH
+          export LD_LIBRARY_PATH
+          export INITIAL_GISBASE
+          export INITIAL_PWD
           python utils/coverage_mapper.py
           coverage combine
           coverage html

From 015d8153b12d6f9d7b8203678dc6ea758b6511c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:27:23 +0000
Subject: [PATCH 37/42] CI: Address zizmor issue in pytest.yml workflow

Cache poisoning is less problematic here as pytest workflow not really used for release artifacts
---
 .github/workflows/pytest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index e9e7d81ba39..c54e3162312 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -42,7 +42,7 @@ jobs:
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}
-          cache: pip
+          cache: pip # zizmor: ignore[cache-poisoning] This pytest workflow not used for release artifacts
           allow-prereleases: true
 
       - name: Install non-Python dependencies

From ae7e1a8d118b96f163805153f06e2fbbc4fbaf19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:29:28 +0000
Subject: [PATCH 38/42] CI: Address actionlint/shellcheck issues in
 codeql-analysis.yml workflow

---
 .github/workflows/codeql-analysis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 5edd087a3ce..46a1e8ae67b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -70,11 +70,11 @@ jobs:
 
       - name: Set LD_LIBRARY_PATH for compilation
         run: |
-          echo "LD_LIBRARY_PATH=${HOME}/install/lib" >> $GITHUB_ENV
+          echo "LD_LIBRARY_PATH=${HOME}/install/lib" >> "${GITHUB_ENV}"
 
       - name: Set number of cores for compilation
         run: |
-          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
+          echo "MAKEFLAGS=-j$(nproc)" >> "${GITHUB_ENV}"
 
       - name: Build
         if: ${{ matrix.language == 'c-cpp' }}

From d8d67b6ce71f9910b9ba32d4c3295ee3b883ebf8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:38:27 +0000
Subject: [PATCH 39/42] CI: Address actionlint/shellcheck issues in
 python-code-quality.yml workflow

---
 .github/workflows/python-code-quality.yml | 24 ++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/python-code-quality.yml b/.github/workflows/python-code-quality.yml
index 8c301fc8d65..3b4c526551d 100644
--- a/.github/workflows/python-code-quality.yml
+++ b/.github/workflows/python-code-quality.yml
@@ -45,13 +45,15 @@ jobs:
     steps:
       - name: Versions
         run: |
-          echo OS: ${{ matrix.os }}
-          echo Python: ${{ env.PYTHON_VERSION }}
-          echo Minimal Python version: ${{ env.MIN_PYTHON_VERSION }}
-          echo Flake8: ${{ env.FLAKE8_VERSION }}
-          echo Pylint: ${{ env.PYLINT_VERSION }}
-          echo Bandit: ${{ env.BANDIT_VERSION }}
-          echo Ruff: ${{ env.RUFF_VERSION }}
+          echo "OS: ${MATRIX_OS}"
+          echo "Python: ${PYTHON_VERSION}"
+          echo "Minimal Python version: ${MIN_PYTHON_VERSION}"
+          echo "Flake8: ${FLAKE8_VERSION}"
+          echo "Pylint: ${PYLINT_VERSION}"
+          echo "Bandit: ${BANDIT_VERSION}"
+          echo "Ruff: ${RUFF_VERSION}"
+        env:
+          MATRIX_OS: ${{ matrix.os }}
 
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
@@ -66,7 +68,7 @@ jobs:
         run: python -m pip install --upgrade pip
 
       - name: Install Ruff
-        run: pip install ruff==${{ env.RUFF_VERSION }}
+        run: pip install "ruff==${RUFF_VERSION}"
       - name: Run Ruff (output annotations on fixable errors)
         run: ruff check --output-format=github . --preview --unsafe-fixes
         continue-on-error: true
@@ -104,11 +106,11 @@ jobs:
           pip install -r .github/workflows/optional_requirements.txt
           pip install --user pipx
           pipx ensurepath
-          pipx install flake8==${{ env.FLAKE8_VERSION }}
-          pipx install pylint==${{ env.PYLINT_VERSION }}
+          pipx install "flake8==${FLAKE8_VERSION}"
+          pipx install "pylint==${PYLINT_VERSION}"
           pipx inject pylint -r .github/workflows/python_requirements.txt -r .github/workflows/optional_requirements.txt
           # The extra toml is only needed before Python 3.11
-          pipx install bandit[sarif,toml]==${{ env.BANDIT_VERSION }}
+          pipx install "bandit[sarif,toml]==${BANDIT_VERSION}"
 
       - name: Run Flake8
         run: |

From 6d96ae81bd2df689f5a8372598614395f5a18037 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:39:06 +0000
Subject: [PATCH 40/42] CI: Address zizmor issue in python-code-quality.yml
 workflow

Cache poisoning is less problematic here as python-code-quality workflow not really used for release artifacts
---
 .github/workflows/python-code-quality.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/python-code-quality.yml b/.github/workflows/python-code-quality.yml
index 3b4c526551d..3867c3a32ed 100644
--- a/.github/workflows/python-code-quality.yml
+++ b/.github/workflows/python-code-quality.yml
@@ -63,7 +63,7 @@ jobs:
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
-          cache: pip
+          cache: pip # zizmor: ignore[cache-poisoning] Not creating release artifacts, less of a concern here
       - name: Upgrade pip
         run: python -m pip install --upgrade pip
 

From 9d27e3a9ceb1348f43b8a83e2d98ca0871592b07 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:48:05 +0000
Subject: [PATCH 41/42] CI: Address actionlint/shellcheck and zizmor issues in
 osgeo4w.yml workflow

---
 .github/workflows/osgeo4w.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/osgeo4w.yml b/.github/workflows/osgeo4w.yml
index 0ecd236f08a..158eafa69b8 100644
--- a/.github/workflows/osgeo4w.yml
+++ b/.github/workflows/osgeo4w.yml
@@ -100,7 +100,7 @@ jobs:
 
       - name: Set number of cores for compilation
         run: |
-          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
+          echo "MAKEFLAGS=-j$(nproc)" >> "${GITHUB_ENV}"
         shell: msys2 {0}
 
       - name: Compile GRASS
@@ -116,7 +116,7 @@ jobs:
         run: .github/workflows/print_versions.sh
 
       - name: Test executing of the grass command
-        run: .github/workflows/test_simple.bat '${{env.O4WROOT}}\opt\grass\grass85.bat'
+        run: .github/workflows/test_simple.bat '%O4WROOT%\opt\grass\grass85.bat'
         env:
           O4WROOT: ${{ steps.osgeo4w.outputs.root }}
 
@@ -161,7 +161,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Run tests
-        run: .github/workflows/test_thorough.bat '${{env.O4WROOT}}\opt\grass\grass85.bat' '${{env.O4WROOT}}\bin\python3'
+        run: .github/workflows/test_thorough.bat '%O4WROOT%\opt\grass\grass85.bat' '%O4WROOT%\bin\python3'
         env:
           O4WROOT: ${{ steps.osgeo4w.outputs.root }}
 

From 80c57b7b494a0bb85579d94139985da8810dc80b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edouard=20Choini=C3=A8re?=
 <27212526+echoix@users.noreply.github.com>
Date: Mon, 1 Sep 2025 00:53:24 +0000
Subject: [PATCH 42/42] checks: Add actionlint and zizmor to pre-commit hooks

---
 .pre-commit-config.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2fe569513df..4963aa58bd8 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -77,6 +77,14 @@ repos:
     rev: v1.37.1
     hooks:
       - id: yamllint
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+      - id: actionlint
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.12.1
+    hooks:
+      - id: zizmor
   - repo: https://github.com/editorconfig-checker/editorconfig-checker
     rev: v3.4.0
     hooks: