Pepijn b746cd3c61 fix(profiling): sort import + move expressions to env vars for zizmor ...

Pre-commit Quality gate flagged two issues:

1. ruff/isort: `from numbers import Real` must sort after
   `from collections.abc import Callable` (stdlib alphabetical order).

2. zizmor (high): `github.head_ref`, `github.ref_name`,
   `github.event.inputs.git_ref`, and `github.event.pull_request.head.sha`
   were expanded directly in `run:` shell blocks, which zizmor flags as
   attacker-controllable. Move all four into job-level `env:` vars
   (GIT_REF, PR_NUMBER, HOST_GIT_COMMIT) so the shell only sees env-var
   references — the same pattern the workflow already uses for
   PROFILE_MODE, POLICY_FILTER, etc.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-16 13:30:13 +02:00

..

ISSUE_TEMPLATE

chore(ci): minor improvement bug-report template & pr auto label (#2676)

2025-12-18 00:23:23 +01:00

workflows

fix(profiling): sort import + move expressions to env vars for zizmor

2026-04-16 13:30:13 +02:00

labeler.yml

chore(ci): minor improvements auto labeling (#2675)

2025-12-17 22:54:47 +01:00

PULL_REQUEST_TEMPLATE.md

chore(docs): update contributing (#3387)

2026-04-15 11:02:37 +02:00