Cyilp64 compile test

.github/workflows/array_api.yml

@@ -44,6 +44,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
 
       - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
         with:
@@ -63,9 +64,11 @@ jobs:
       - name: Test
         run: |
           export OMP_NUM_THREADS=2
-          for task in ${{ join(matrix.tasks, ' ') }}; do
+          for task in ${TASKS}; do
             pixi run --skip-deps "$task" -- --durations 3 --timeout=60
           done
+        env:
+          TASKS: ${{ join(matrix.tasks, ' ') }}
 
       - name: Ccache performance
         shell: bash -l {0}

.github/workflows/circle_artifacts.yml

@@ -2,16 +2,22 @@ name: Redirect circleci artifacts
 
 on: [status]
 
-permissions:
-  statuses: write  # to report circleci status (scientific-python/circleci-artifacts-redirector-action)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
 
 jobs:
   circleci_artifacts_redirector_job:
     runs-on: ubuntu-22.04
+    environment: circleci-redirector
     if: >
       github.repository == 'scipy/scipy'
       && github.event.context == 'ci/circleci: build_docs'
     name: Run CircleCI artifacts redirector
+    permissions:
+      statuses: write # needed to communicate status
     steps:
       - name: GitHub Action step
         uses: scientific-python/circleci-artifacts-redirector-action@5d358ff96e96429a5c64a969bb4a574555439f4f # v1.3.1

.github/workflows/codeql.yml

@@ -17,6 +17,10 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -27,15 +31,8 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
+      security-events: write  # required for all workflows
+      packages: read  # required to fetch internal or private CodeQL packs
 
     strategy:
       fail-fast: false
@@ -58,6 +55,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/commit_message.yml

@@ -23,6 +23,7 @@ jobs:
         # Gets the correct commit message for pull request
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
 
       - name: Check for skips
         id: skip_check

.github/workflows/gpu-ci.yml

@@ -68,6 +68,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Cache pixi
         uses: cirruslabs/cache@1251dca905f872d6420b06b8d7f9e7fc85589448 # v4

.github/workflows/issue-labeler.yml

@@ -5,13 +5,18 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   label_issue:
+    name: "Label Issue"
     # Permissions needed for labelling issues automatically
     # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
     permissions:
       contents: read
-      issues: write
+      issues: write  # needed to apply label
     runs-on: ubuntu-latest
     steps:
     # label based on issue title

.github/workflows/label-pr-on-close.yml

@@ -5,14 +5,18 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   label_pull_request:
     name: "Label PR on Close"
     # Permissions needed for labelling Pull Requests automatically
     # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
     permissions:
       contents: read
-      pull-requests: write
+      pull-requests: write  # needed to apply label
     runs-on: ubuntu-latest
     steps:
     - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4

.github/workflows/label-pr-on-open.yml

@@ -5,13 +5,18 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   label_pull_request:
+    name: Label PR
     # Permissions needed for labelling Pull Requests automatically
     # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
     permissions:
       contents: read
-      pull-requests: write
+      pull-requests: write  # needed to apply label
     runs-on: ubuntu-latest
     steps:
     # label based on changed files

.github/workflows/lint.yml

@@ -27,6 +27,7 @@ jobs:
         with:
           fetch-depth: 0 # previous commits used in tools/lint.py
           submodules: recursive
+          persist-credentials: false
 
       - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
         with:
@@ -44,9 +45,10 @@ jobs:
         run: pixi run check-python-h
 
       - name: Check module interdependencies
-        working-directory: .github/workflows
         run: pixi run tach-check
 
       - name: Check external dependencies
-        working-directory: .github/workflows
         run: pixi run tach-check-external
+
+      - name: GitHub Actions static analysis
+        run: pixi run zizmor

.github/workflows/linux.yml

@@ -48,6 +48,7 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         submodules: recursive
+        persist-credentials: false
 
     - name: Setup Python
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -141,6 +142,7 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         submodules: recursive
+        persist-credentials: false
 
     - name: Install Ubuntu dependencies
       run: |
@@ -213,6 +215,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Configuring Test Environment
         run: |
@@ -248,6 +251,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -318,6 +322,7 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         submodules: recursive
+        persist-credentials: false
 
     - name: Setup Python
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -378,6 +383,7 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         submodules: recursive
+        persist-credentials: false
 
     - name: build + test in i686 container
       run: |
@@ -420,6 +426,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Setup system dependencies
         run: |
@@ -481,6 +488,7 @@ jobs:
         with:
           submodules: recursive
           fetch-tags: true
+          persist-credentials: false
 
       - name: Install system dependencies
         run: |
@@ -536,6 +544,7 @@ jobs:
 
   #################################################################################
   free-threaded:
+    name: free-threaded
     needs: get_commit_message
     strategy:
       matrix:
@@ -550,6 +559,7 @@ jobs:
       with:
         submodules: recursive
         fetch-tags: true
+        persist-credentials: false
 
     - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
@@ -639,6 +649,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -674,6 +685,7 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         submodules: recursive
+        persist-credentials: false
 
     - name: Setup Python
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -716,6 +728,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
 
       - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
         with: