catch3/.github/workflows/dependency-review.yml, branch feature/cpp-tools Progmasoft Catch3: an independently maintained C++17 test framework with a parallel runner, property checks, snapshots and structured results. Move to the Progmasoft Linking Exception, Version 2.0 2026-10-31T10:42:35+00:00 Leitwolf11 2026-10-31T10:42:35+00:00 31486e3217b8424809bcf129c0ef24ef5639e919 Version 1.1 left programs built with Progmasoft tools under MPL-2.0 duties for the code the tools place in them, and left other cases unclear. Version 2.0 adds a generated code permission, covers runtime and standard libraries, compiler transformations, interfaces and examples, and settles how a file is identified and how to tell recipients about source. Every project SPDX expression moves to AdditionRef-Progmasoft-Exception-2.0. The older texts stay, because released versions name them. 
Version 1.1 left programs built with Progmasoft tools under MPL-2.0 duties
for the code the tools place in them, and left other cases unclear.
Version 2.0 adds a generated code permission, covers runtime and standard
libraries, compiler transformations, interfaces and examples, and settles
how a file is identified and how to tell recipients about source.

Every project SPDX expression moves to AdditionRef-Progmasoft-Exception-2.0.
The older texts stay, because released versions name them.
Add workflow, repository and dependency analysis 2026-10-10T17:23:52+00:00 Leitwolf11 2026-10-10T17:23:52+00:00 ba6cbc4e6fc71f7b2240f9c42f1124dc2e9b6532 zizmor audits the workflows themselves for what makes a workflow unsafe, and uploads what it finds to code scanning. Its first run here found one thing, 11 times: a checkout that leaves the job's token in the checked-out repository, where any later step can read it. No workflow pushes or needs the token after the checkout, so every checkout now sets persist-credentials to false, and zizmor reports nothing. OpenSSF Scorecard grades how the repository is kept: branch protection, pinned dependencies, token permissions and the like. It runs on the default branch and weekly and uploads its findings to code scanning. Dependency Review fails a pull request that adds or changes a dependency with a known vulnerability of high severity or worse. Dependabot watches what is already there; this holds what comes in. Every new action is pinned to a commit, each job names the permissions it needs, and no new workflow has a default permission. Two steps of the Windows build ran in the CMD shell, which zizmor cannot read into; they run in PowerShell now, with the same commands and the processor count taken from the environment. 
zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 11 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.

OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly and uploads its findings to
code scanning.

Dependency Review fails a pull request that adds or changes a dependency
with a known vulnerability of high severity or worse. Dependabot watches
what is already there; this holds what comes in.

Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.

Two steps of the Windows build ran in the CMD shell, which zizmor cannot

read into; they run in PowerShell now, with the same commands and the

processor count taken from the environment.