CERALIVE · andrescera · Jun 21, 2026 · Jun 21, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: "npm"
+    directory: "/bindings/typescript"
+    schedule:
+      interval: "weekly"
+    groups:
+      npm-bindings:
+        patterns: ["*"]
diff --git a/.github/workflows/bindings.yml b/.github/workflows/bindings.yml
@@ -12,6 +12,13 @@ on:
       - "bindings/typescript/**"
       - ".github/workflows/bindings.yml"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: bindings-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-and-test:
     name: Build & Test
@@ -21,7 +28,7 @@ jobs:
         working-directory: bindings/typescript
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
@@ -43,8 +50,10 @@ jobs:
       - name: Summary
         if: success()
         run: |
-          echo "## TypeScript bindings green" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- Type-check: bun run lint" >> $GITHUB_STEP_SUMMARY
-          echo "- Build: bun run build" >> $GITHUB_STEP_SUMMARY
-          echo "- Tests: bun test" >> $GITHUB_STEP_SUMMARY
+          {
+            echo "## TypeScript bindings green"
+            echo ""
+            echo "- Type-check: bun run lint"
+            echo "- Build: bun run build"
+            echo "- Tests: bun test"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/build-check.yml b/.github/workflows/build-check.yml
@@ -6,6 +6,13 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: build-check-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: Build ${{ matrix.arch }}
@@ -19,19 +26,28 @@ jobs:
             runner: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Install dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y build-essential cmake git
+          sudo apt-get install -y build-essential cmake git ccache
+
+      - name: Cache ccache
+        uses: actions/cache@v5
+        with:
+          path: ~/.ccache
+          key: ccache-${{ runner.os }}-${{ matrix.arch }}-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ runner.os }}-${{ matrix.arch }}-
 
       - name: Build srtla
         run: |
-          cmake -B build -DCMAKE_BUILD_TYPE=Release
-          cmake --build build -j$(nproc)
+          cmake -B build -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+          cmake --build build -j"$(nproc)"
 
       - name: Run tests
         run: |
@@ -45,7 +61,9 @@ jobs:
 
       - name: Build Summary
         run: |
-          echo "## ✅ Build Check Passed" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Architecture:** ${{ matrix.arch }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Runner:** ${{ matrix.runner }}" >> $GITHUB_STEP_SUMMARY
+          {
+            echo "## ✅ Build Check Passed"
+            echo ""
+            echo "**Architecture:** ${{ matrix.arch }}"
+            echo "**Runner:** ${{ matrix.runner }}"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/compat-matrix.yml b/.github/workflows/compat-matrix.yml
@@ -53,7 +53,7 @@ jobs:
       has_informational: ${{ steps.gen.outputs.has_informational }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install PyYAML
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends jq python3-yaml
@@ -100,12 +100,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Restore external image cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: /tmp/compat-images
           key: compat-images-blocking-${{ hashFiles('tests/compat/matrix.yaml', 'tests/compat/docker/**') }}
@@ -120,7 +120,7 @@ jobs:
 
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: compat-results-blocking
           path: tests/compat/results/**/result.json
@@ -136,12 +136,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Restore external image cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: /tmp/compat-images
           key: compat-images-informational-${{ hashFiles('tests/compat/matrix.yaml', 'tests/compat/docker/**') }}
@@ -156,7 +156,7 @@ jobs:
 
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: compat-results-informational
           path: tests/compat/results/**/result.json
@@ -174,7 +174,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
           lfs: true
@@ -220,7 +220,7 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -238,7 +238,7 @@ jobs:
 
       - name: Upload drift results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: compat-results-drift
           path: tests/compat/results/**/result.json

diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
@@ -12,6 +12,13 @@ on:
           - beta
         default: stable
 
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   calculate-version:
     name: Calculate Version
@@ -21,7 +28,7 @@ jobs:
       channel: ${{ steps.calver.outputs.channel }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -59,8 +66,10 @@ jobs:
             CHANNEL="stable"
           fi
 
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          echo "channel=${CHANNEL}" >> $GITHUB_OUTPUT
+          {
+            echo "version=${VERSION}"
+            echo "channel=${CHANNEL}"
+          } >> "$GITHUB_OUTPUT"
           echo "Version: ${VERSION} (Channel: ${CHANNEL})"
 
   build-deb:
@@ -76,7 +85,7 @@ jobs:
             runner: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -88,8 +97,8 @@ jobs:
       - name: Build srtla
         run: |
           cmake -B build -DCMAKE_BUILD_TYPE=Release -DSRTLA_BUILD_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/usr
-          cmake --build build -j$(nproc)
-          DESTDIR=$PWD/install cmake --install build
+          cmake --build build -j"$(nproc)"
+          DESTDIR="$PWD/install" cmake --install build
 
       - name: Install FPM
         run: sudo gem install fpm
@@ -117,19 +126,19 @@ jobs:
             install/usr/=/usr/
 
           # Create .tar.gz archive
-          mkdir -p tarball/srtla-${VERSION}
-          cp -r install/usr/* tarball/srtla-${VERSION}/
+          mkdir -p "tarball/srtla-${VERSION}"
+          cp -r install/usr/* "tarball/srtla-${VERSION}/"
           cd tarball
-          tar -czvf ../dist/srtla_${VERSION}_${ARCH}.tar.gz srtla-${VERSION}
+          tar -czvf "../dist/srtla_${VERSION}_${ARCH}.tar.gz" "srtla-${VERSION}"
           cd ..
 
           # Create checksums
           cd dist
-          sha256sum srtla_${VERSION}_${ARCH}.deb > srtla_${VERSION}_${ARCH}.deb.sha256
-          sha256sum srtla_${VERSION}_${ARCH}.tar.gz > srtla_${VERSION}_${ARCH}.tar.gz.sha256
+          sha256sum "srtla_${VERSION}_${ARCH}.deb" > "srtla_${VERSION}_${ARCH}.deb.sha256"
+          sha256sum "srtla_${VERSION}_${ARCH}.tar.gz" > "srtla_${VERSION}_${ARCH}.tar.gz.sha256"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: srtla-${{ matrix.arch }}
           path: |
@@ -145,7 +154,7 @@ jobs:
       contents: write
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
@@ -166,7 +175,7 @@ jobs:
       # per-repo reindex race. R2 upload is handled by apt-worker.
 
       - name: Trigger centralized APT reindex
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@v4
         with:
           token: ${{ secrets.CERALIVE_DISPATCH_TOKEN }}
           repository: CERALIVE/apt-worker
@@ -175,7 +184,7 @@ jobs:
             {"component":"srtla","repo":"srtla","channel":"${{ needs.calculate-version.outputs.channel }}","tag":"v${{ needs.calculate-version.outputs.version }}","version":"${{ needs.calculate-version.outputs.version }}"}
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ needs.calculate-version.outputs.version }}
           name: srtla v${{ needs.calculate-version.outputs.version }}

diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
@@ -6,13 +6,20 @@ on:
   pull_request:
     branches: [ main, master ]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: static-analysis-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   clang-tidy:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -23,11 +30,21 @@ jobs:
             clang-tidy \
             cmake \
             pkg-config \
-            libspdlog-dev
+            libspdlog-dev \
+            ccache
+
+      - name: Cache ccache
+        uses: actions/cache@v5
+        with:
+          path: ~/.ccache
+          key: ccache-${{ runner.os }}-clang-tidy-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ runner.os }}-clang-tidy-
 
       - name: Configure CMake
         run: |
-          cmake -B build -DSRTLA_BUILD_TESTS=OFF -DSRTLA_ENABLE_CLANG_TIDY=OFF
+          cmake -B build -DSRTLA_BUILD_TESTS=OFF -DSRTLA_ENABLE_CLANG_TIDY=OFF \
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
 
       - name: Run clang-tidy
         run: |
@@ -38,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -48,11 +65,21 @@ jobs:
           sudo apt-get install -y \
             cmake \
             pkg-config \
-            libspdlog-dev
+            libspdlog-dev \
+            ccache
+
+      - name: Cache ccache
+        uses: actions/cache@v5
+        with:
+          path: ~/.ccache
+          key: ccache-${{ runner.os }}-test-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ runner.os }}-test-
 
       - name: Configure CMake
         run: |
-          cmake -B build -DSRTLA_BUILD_TESTS=ON
+          cmake -B build -DSRTLA_BUILD_TESTS=ON \
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
 
       - name: Build
         run: |