Modify: shell prologue, sha pins

Author: xsscx

.github/workflows/ci-comprehensive-build-test.yml

@@ -81,7 +81,7 @@ jobs:
 
       - name: Cache Dependencies (Linux)
         if: runner.os == 'Linux'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             /var/cache/apt/archives
@@ -93,7 +93,7 @@ jobs:
 
       - name: Cache Dependencies (macOS)
         if: runner.os == 'macOS'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             ~/Library/Caches/Homebrew
@@ -348,7 +348,7 @@ jobs:
           persist-credentials: false
 
       - name: Cache Dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             /var/cache/apt/archives
@@ -658,7 +658,7 @@ jobs:
           git config --global credential.helper ""
 
       - name: Setup MSBuild
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce  # v2
 
       - name: Clone iccDEV
         run: |

.github/workflows/ci-docker-latest.yml

@@ -41,6 +41,9 @@ jobs:
     name: "Build iccDEV Docker"
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash --noprofile --norc {0}
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -118,9 +121,13 @@ jobs:
         run: docker build -f Dockerfile -t iccdev-test:latest .
 
       - name: Verify tools
-        shell: bash
+        env:
+          BASH_ENV: /dev/null
         run: |
           set -euo pipefail
+          git config --add safe.directory "$PWD"
+          git config --global credential.helper ""
+          unset GITHUB_TOKEN || true
           TOOL_COUNT=$(docker run --rm iccdev-test:latest bash -c \
             'find /opt/iccdev/Build/Tools -type f -executable | wc -l')
           echo "Tools built: $TOOL_COUNT"
@@ -145,9 +152,13 @@ jobs:
             >> "$GITHUB_STEP_SUMMARY"
           echo '```' >> "$GITHUB_STEP_SUMMARY"
       - name: Test tool execution
-        shell: bash
+        env:
+          BASH_ENV: /dev/null
         run: |
           set -euo pipefail
+          git config --add safe.directory "$PWD"
+          git config --global credential.helper ""
+          unset GITHUB_TOKEN || true
           FAILURES=0
           echo "### Tool Tests" >> "$GITHUB_STEP_SUMMARY"
           for tool in iccToXml iccFromXml iccDumpProfile iccRoundTrip; do
@@ -165,9 +176,13 @@ jobs:
             exit 1
           fi
       - name: Test iccToXml profile conversion
-        shell: bash
+        env:
+          BASH_ENV: /dev/null
         run: |
           set -euo pipefail
+          git config --add safe.directory "$PWD"
+          git config --global credential.helper ""
+          unset GITHUB_TOKEN || true
           echo "### iccToXml Profile Conversion" >> "$GITHUB_STEP_SUMMARY"
           docker run --rm iccdev-test:latest bash -c '
             set -euo pipefail

.github/workflows/ci-docker-nixos.yml

@@ -37,6 +37,9 @@ jobs:
     name: "Build iccDEV NixOS Docker"
     runs-on: ubuntu-latest
     timeout-minutes: 45
+    defaults:
+      run:
+        shell: bash --noprofile --norc {0}
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -115,9 +118,13 @@ jobs:
         run: docker build -f Dockerfile.nixos -t iccdev-nixos-test:latest .
 
       - name: Verify tools
-        shell: bash
+        env:
+          BASH_ENV: /dev/null
         run: |
           set -euo pipefail
+          git config --add safe.directory "$PWD"
+          git config --global credential.helper ""
+          unset GITHUB_TOKEN || true
           TOOL_COUNT=$(docker run --rm iccdev-nixos-test:latest sh -c \
             'find /workspace/iccDEV/Build/Tools -type f -executable | wc -l')
           echo "Tools built: $TOOL_COUNT"
@@ -134,9 +141,13 @@ jobs:
           echo '```' >> "$GITHUB_STEP_SUMMARY"
 
       - name: Test tool execution
-        shell: bash
+        env:
+          BASH_ENV: /dev/null
         run: |
           set -euo pipefail
+          git config --add safe.directory "$PWD"
+          git config --global credential.helper ""
+          unset GITHUB_TOKEN || true
           FAILURES=0
           echo "### Tool Tests" >> "$GITHUB_STEP_SUMMARY"
           for tool in iccToXml iccFromXml iccDumpProfile iccRoundTrip; do
@@ -155,9 +166,13 @@ jobs:
           fi
 
       - name: Test iccToXml profile conversion
-        shell: bash
+        env:
+          BASH_ENV: /dev/null
         run: |
           set -euo pipefail
+          git config --add safe.directory "$PWD"
+          git config --global credential.helper ""
+          unset GITHUB_TOKEN || true
           echo "### iccToXml Profile Conversion" >> "$GITHUB_STEP_SUMMARY"
           docker run --rm iccdev-nixos-test:latest sh -c '
             set -euo pipefail

Dockerfile

@@ -52,7 +52,7 @@ RUN groupadd -r iccdev \
  && useradd -r -g iccdev -d /opt/iccdev -s /bin/bash iccdev \
  && chown -R iccdev:iccdev /opt/iccdev
 
-ENV PATH="/opt/iccdev/Build/Tools/IccToXml:/opt/iccdev/Build/Tools/IccFromXml:/opt/iccdev/Build/Tools/IccDumpProfile:/opt/iccdev/Build/Tools/IccApplyNamedCmm:/opt/iccdev/Build/Tools/IccRoundTrip:/opt/iccdev/Build/Tools/IccFromCube:/opt/iccdev/Build/Tools/IccApplyProfiles:/opt/iccdev/Build/Tools/IccApplySearch:/opt/iccdev/Build/Tools/IccApplyToLink:/opt/iccdev/Build/Tools/IccPngDump:/opt/iccdev/Build/Tools/IccSpecSepToTiff:/opt/iccdev/Build/Tools/IccTiffDump:/opt/iccdev/Build/Tools/IccV5DspObsToV4Dsp:${PATH}"
+ENV PATH="/opt/iccdev/Build/Tools/IccToXml:/opt/iccdev/Build/Tools/IccFromXml:/opt/iccdev/Build/Tools/IccDumpProfile:/opt/iccdev/Build/Tools/IccApplyNamedCmm:/opt/iccdev/Build/Tools/IccRoundTrip:/opt/iccdev/Build/Tools/IccFromCube:/opt/iccdev/Build/Tools/IccApplyProfiles:/opt/iccdev/Build/Tools/IccApplySearch:/opt/iccdev/Build/Tools/IccApplyToLink:/opt/iccdev/Build/Tools/IccJpegDump:/opt/iccdev/Build/Tools/IccPngDump:/opt/iccdev/Build/Tools/IccSpecSepToTiff:/opt/iccdev/Build/Tools/IccTiffDump:/opt/iccdev/Build/Tools/IccV5DspObsToV4Dsp:${PATH}"
 
 USER iccdev
 WORKDIR /opt/iccdev

Dockerfile.nixos

@@ -20,7 +20,7 @@
 ###############################################################
 
 # Use official NixOS Docker image
-FROM nixos/nix:latest
+FROM nixos/nix:2.33.2@sha256:c6ebd12d96b3374ee15e3986c15aa43f5e49310634f17afcaaf4dafe4f6732b2
 
 LABEL org.opencontainers.image.title="iccDEV Build Container (NixOS)" \
       org.opencontainers.image.description="iccDEV built with Nix package manager" \
@@ -42,7 +42,7 @@ RUN nix-shell -p git cmake gcc gnumake pkg-config libxml2 libtiff libjpeg libpng
     echo "=== Building iccDEV from HEAD ===" && \
     git log -1 --oneline && \
     cd Build && \
-    cmake Cmake && \
+    cmake -DCMAKE_BUILD_TYPE=Release Cmake && \
     make -j$(nproc) && \
     echo "=== Build Complete ===" && \
     echo "Built tools:" && \
@@ -101,8 +101,8 @@ echo ""
 echo "iccDEV Libraries (in /workspace/iccDEV/Build):"
 echo ""
 echo "Shared Libraries (.so):"
-echo "  - IccProfLib/libIccProfLib2.so.2.3.1.4"
-echo "  - IccXML/libIccXML2.so.2.3.1.4"
+echo "  - IccProfLib/libIccProfLib2.so -> libIccProfLib2.so.<version>"
+echo "  - IccXML/libIccXML2.so -> libIccXML2.so.<version>"
 echo ""
 echo "Static Libraries (.a):"
 echo "  - IccProfLib/libIccProfLib2-static.a"