C++17 is still the widest common target, and a library built on it stays
usable from C++17 and every later standard, while C++20 would have left
out many users.

Concepts become enable_if on named traits in Detail/TypeTraits.hpp, which
also replaces std::remove_cvref_t and std::identity. std::span becomes
std::vector references, std::bit_cast becomes static_cast and memcpy,
template lambdas become helper templates, and std::erase_if, contains,
starts_with and ends_with have their C++17 forms. Random::Between no
longer uses a lambda over a constexpr local, which MSVC rejects outside
/permissive-, so the headers work under its default mode too.

Tests give up designated initializers, which MSVC refuses in C++17. CI
builds the matrix in C++17 and C++20, since the headers promise both.

macOS runners are the bottleneck of Progmasoft's CI: an organization
runs at most five macOS jobs at a time, shared by every repository, and a
pull request of Catch3 asked for about twenty of them. Every workflow
also listened to both push and pull_request, so each pull request ran
everything twice, once for its branch and once for the pull request.

macOS now has one job, as in the Tala compiler: macOS 26 on Apple
Silicon, Debug, C++17, with AddressSanitizer and UndefinedBehaviorSanitizer
over the most-tests preset, examples and extra tests. The C++14 and C++17,
Debug and Release matrix stays on Ubuntu and Fedora, where it already ran.
ThreadSanitizer, which ran only on macOS, moves to a new Ubuntu job.

The build systems that tested Windows and macOS (Bazel, Meson, Xmake,
Premake) test Windows and Ubuntu instead, with Clang, so their Unix side
is still covered and Linux is covered for the first time. The jobs that do
not depend on the platform leave macOS: CodeQL (build mode none), the
header and license checks, and native coverage, which now builds with
the Clang and LLVM tools of Ubuntu instead of those of Xcode.

Pushes build only devel; pull requests build their branches. The weekly
CodeQL schedule stays.

The required check "Bazel on macos-15" becomes "Bazel on ubuntu-26.04" in
the branch protection and the ruleset when this is merged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The compiler that uses this framework first is built and tested on
Windows with the Visual Studio 2026 image, macOS 15 and 26, Ubuntu 26.04
and Fedora 43. This repository was tested on Windows Server 2022 and
2025, macOS 14, 15 and 15 on Intel, and on no Linux at all.

The Windows builds move to the windows-2025-vs2026 image, in the basic
builds and in the Xmake, Bazel and Meson builds. The macOS builds and
the sanitizer builds run on macos-15 and macos-26. A new workflow builds
and tests on Ubuntu 26.04 and, in a container, on Fedora 43, with Clang,
as C++14 and C++17, Debug and Release.

Two jobs stay on windows-2022: the Premake job generates Visual Studio
2022 projects, and the Conan job names the Visual Studio 17 generator
and the v144 runtime. Moving them means moving those tools to Visual
Studio 2026, which is a change of its own.

zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 11 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.

OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly and uploads its findings to
code scanning.

Dependency Review fails a pull request that adds or changes a dependency
with a known vulnerability of high severity or worse. Dependabot watches
what is already there; this holds what comes in.

Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.

Two steps of the Windows build ran in the CMD shell, which zizmor cannot

read into; they run in PowerShell now, with the same commands and the

processor count taken from the environment.

Fix warning that Node.js 20 is disconinued in June