From 03f4d308f1a269bde62e48ff376a296dc480f0ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lukas=20D=C3=BCrrenberger?= <eXpl0it3r@my-gate.net>
Date: Sat, 3 Oct 2026 12:47:32 +0200
Subject: [PATCH 1/3] Update GitHub runner images and Actions versions

The new Windows runner images ship Visual Studio 2026, which requires CMake 4.2 or later.
---
 .github/workflows/ci.yml      | 28 +++++++++----------
 .github/workflows/nuget.yml   | 38 ++++++++++++-------------
 .github/workflows/release.yml | 52 +++++++++++++++++------------------
 tools/nuget/build.win.ps1     |  2 +-
 4 files changed, 60 insertions(+), 60 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 543b44ee..6a6514cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,10 +22,10 @@ jobs:
       fail-fast: false
       matrix:
         platform:
-        - { name: Windows VS2022 x86,  os: windows-2025, flags: -AWin32 }
-        - { name: Windows VS2022 x64,  os: windows-2025, flags: -Ax64 }
-        - { name: Windows ClangCL,     os: windows-2025, flags: -T ClangCL }
-        - { name: Windows Clang,       os: windows-2025, flags: -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ }
+        - { name: Windows VS2026 x86,  os: windows-2025-vs2026, flags: -AWin32 }
+        - { name: Windows VS2026 x64,  os: windows-2025-vs2026, flags: -Ax64 }
+        - { name: Windows ClangCL,     os: windows-2025-vs2026, flags: -T ClangCL }
+        - { name: Windows Clang,       os: windows-2025-vs2026, flags: -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ }
         - { name: Linux GCC,           os: ubuntu-24.04, flags: -GNinja }
         - { name: Linux Clang,         os: ubuntu-24.04, flags: -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ }
         - { name: MacOS,               os: macos-15,     flags: -GNinja }
@@ -40,7 +40,7 @@ jobs:
     - name: Get CMake and Ninja
       uses: lukka/get-cmake@latest
       with:
-        cmakeVersion: ${{ runner.os == 'Windows' && '3.25' || '3.22' }}
+        cmakeVersion: ${{ runner.os == 'Windows' && '4.2' || '3.22' }} # Visual Studio 2026 generator requires CMake 4.2 or later
         ninjaVersion: latest
 
     - name: Install Linux Dependencies
@@ -48,7 +48,7 @@ jobs:
       run: sudo apt-get update && sudo apt-get install libxrandr-dev libxcursor-dev libxi-dev libudev-dev libflac-dev libvorbis-dev libgl1-mesa-dev libegl1-mesa-dev libfreetype-dev
 
     - name: Checkout SFML
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         repository: SFML/SFML
         ref: ${{env.SFML_VERSION}}
@@ -66,7 +66,7 @@ jobs:
       run: cmake --build SFML/build --config ${{matrix.type.name}} --target install
 
     - name: Checkout CSFML
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         path: CSFML
 
@@ -96,7 +96,7 @@ jobs:
       run: sudo apt-get install clang-format-17
 
     - name: Checkout Code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Format Code
       run: cmake -DCLANG_FORMAT_EXECUTABLE=clang-format-17 -P cmake/Format.cmake
@@ -112,7 +112,7 @@ jobs:
     - name: Get CMake and Ninja
       uses: lukka/get-cmake@latest
       with:
-        cmakeVersion: ${{ runner.os == 'Windows' && '3.25' || '3.22' }}
+        cmakeVersion: ${{ runner.os == 'Windows' && '4.2' || '3.22' }} # Visual Studio 2026 generator requires CMake 4.2 or later
         ninjaVersion: latest
 
     - name: Install Dependencies
@@ -122,7 +122,7 @@ jobs:
         echo /opt/homebrew/opt/llvm/bin >> $GITHUB_PATH
 
     - name: Checkout SFML
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         repository: SFML/SFML
         ref: ${{env.SFML_VERSION}}
@@ -135,7 +135,7 @@ jobs:
       run: cmake --build SFML/build --target install
 
     - name: Checkout CSFML
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         path: CSFML
 
@@ -153,7 +153,7 @@ jobs:
     - name: Get CMake and Ninja
       uses: lukka/get-cmake@latest
       with:
-        cmakeVersion: ${{ runner.os == 'Windows' && '3.25' || '3.22' }}
+        cmakeVersion: ${{ runner.os == 'Windows' && '4.2' || '3.22' }} # Visual Studio 2026 generator requires CMake 4.2 or later
         ninjaVersion: latest
 
     - name: Install Doxygen
@@ -162,7 +162,7 @@ jobs:
         brew install doxygen ninja || true
 
     - name: Checkout SFML
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         repository: SFML/SFML
         ref: ${{env.SFML_VERSION}}
@@ -175,7 +175,7 @@ jobs:
       run: cmake --build SFML/build --target install
 
     - name: Checkout CSFML
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         path: CSFML
 
diff --git a/.github/workflows/nuget.yml b/.github/workflows/nuget.yml
index 2d8c83df..5143aa7b 100644
--- a/.github/workflows/nuget.yml
+++ b/.github/workflows/nuget.yml
@@ -19,11 +19,11 @@ env:
 jobs:
   windows-x86-x64:
     name: Windows x86 x64
-    runs-on: windows-2025
+    runs-on: windows-2025-vs2026
 
     steps:
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
@@ -40,18 +40,18 @@ jobs:
           ./build.win.ps1 "win-x64"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-win-x86-x64
           path: CSFML/tools/nuget/CSFML/runtimes
 
   windows-arm64:
     name: Windows ARM64
-    runs-on: windows-11-arm
+    runs-on: windows-11-vs2026-arm
 
     steps:
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
@@ -62,7 +62,7 @@ jobs:
           ./build.win.ps1 "win-arm64"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-win-arm64
           path: CSFML/tools/nuget/CSFML/runtimes
@@ -75,7 +75,7 @@ jobs:
 
     steps:
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
@@ -87,7 +87,7 @@ jobs:
           ./docker.linux-x64.sh
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-linux-x64
           path: CSFML/tools/nuget/CSFML/runtimes
@@ -98,7 +98,7 @@ jobs:
 
     steps:
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
@@ -116,7 +116,7 @@ jobs:
           ./build.linux.sh linux-arm arm-linux-gnueabihf-g++ arm-linux-gnueabihf-gcc
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-linux-arm
           path: CSFML/tools/nuget/CSFML/runtimes
@@ -127,7 +127,7 @@ jobs:
 
     steps:
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
@@ -144,7 +144,7 @@ jobs:
           ./build.linux.sh linux-arm64
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-linux-arm64
           path: CSFML/tools/nuget/CSFML/runtimes
@@ -157,7 +157,7 @@ jobs:
 
     steps:
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
@@ -169,7 +169,7 @@ jobs:
           ./docker.linux-musl-x64.sh
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-linux-musl-x64
           path: CSFML/tools/nuget/CSFML/runtimes
@@ -180,7 +180,7 @@ jobs:
 
     steps:
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
@@ -198,7 +198,7 @@ jobs:
           ./build.macos.sh "osx-arm64"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-macOS-x64-arm64
           path: CSFML/tools/nuget/CSFML/runtimes
@@ -216,11 +216,11 @@ jobs:
       - macos-x64-arm64
     steps:
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
       - name: Download Artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           path: CSFML/tools/nuget/CSFML/runtimes
           merge-multiple: true
@@ -238,7 +238,7 @@ jobs:
           cd CSFML/tools/nuget
           dotnet build --configuration Release --verbosity detailed
       - name: Upload NuGet Package
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-NuGet-Package
           path: CSFML/tools/nuget/CSFML/bin/Release/*.nupkg
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2ff24404..dbb081b6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,12 +19,12 @@ env:
 jobs:
   windows-x86:
     name: Windows x86
-    runs-on: windows-2025
+    runs-on: windows-2025-vs2026
 
     steps:
       - name: Cache MinGW x86
         id: mingw-x86-cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ${{ github.workspace }}/mingw32
           key: 15.2.0posix-13.0.0-ucrt-r1-x86
@@ -41,25 +41,25 @@ jobs:
           add_to_path: false
 
       - name: Checkout SFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
 
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
       - name: Build SFML
         run: |
-          cmake -S SFML -B SFML-build -A Win32 -G "Visual Studio 17 2022" -DBUILD_SHARED_LIBS=ON -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/SFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
+          cmake -S SFML -B SFML-build -A Win32 -G "Visual Studio 18 2026" -DBUILD_SHARED_LIBS=ON -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/SFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
           cmake --build SFML-build --config Release --target install
 
       - name: Build CSFML
         run: |
-          cmake -S CSFML -B CSFML-build -A Win32 -G "Visual Studio 17 2022" -DBUILD_SHARED_LIBS=ON -DCSFML_LINK_SFML_STATICALLY=OFF -DCMAKE_BUILD_TYPE=Release -DSFML_ROOT=${{ github.workspace }}/SFML-install -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/CSFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
+          cmake -S CSFML -B CSFML-build -A Win32 -G "Visual Studio 18 2026" -DBUILD_SHARED_LIBS=ON -DCSFML_LINK_SFML_STATICALLY=OFF -DCMAKE_BUILD_TYPE=Release -DSFML_ROOT=${{ github.workspace }}/SFML-install -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/CSFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
           cmake --build CSFML-build --config Release --target install
 
       - name: Add MinGW to PATH
@@ -99,19 +99,19 @@ jobs:
           Move-Item -Path "CSFML-install\*" -Destination "install\CSFML"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-windows-32-bit
           path: install/CSFML
 
   windows-x64:
     name: Windows x64
-    runs-on: windows-2025
+    runs-on: windows-2025-vs2026
 
     steps:
       - name: Cache MinGW x64
         id: mingw-x64-cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ${{ github.workspace }}/mingw64
           key: 15.2.0posix-13.0.0-ucrt-r1-x64
@@ -128,25 +128,25 @@ jobs:
           add_to_path: false
 
       - name: Checkout SFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
 
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
       - name: Build SFML
         run: |
-          cmake -S SFML -B SFML-build -A x64 -G "Visual Studio 17 2022" -DBUILD_SHARED_LIBS=ON -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/SFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
+          cmake -S SFML -B SFML-build -A x64 -G "Visual Studio 18 2026" -DBUILD_SHARED_LIBS=ON -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/SFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
           cmake --build SFML-build --config Release --target install
 
       - name: Build CSFML
         run: |
-          cmake -S CSFML -B CSFML-build -A x64 -G "Visual Studio 17 2022" -DBUILD_SHARED_LIBS=ON -DCSFML_LINK_SFML_STATICALLY=OFF -DCMAKE_BUILD_TYPE=Release -DSFML_ROOT=${{ github.workspace }}/SFML-install -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/CSFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
+          cmake -S CSFML -B CSFML-build -A x64 -G "Visual Studio 18 2026" -DBUILD_SHARED_LIBS=ON -DCSFML_LINK_SFML_STATICALLY=OFF -DCMAKE_BUILD_TYPE=Release -DSFML_ROOT=${{ github.workspace }}/SFML-install -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/CSFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
           cmake --build CSFML-build --config Release --target install
 
       - name: Add MinGW to PATH
@@ -186,36 +186,36 @@ jobs:
           Move-Item -Path "CSFML-install\*" -Destination "install\CSFML"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-windows-64-bit
           path: install/CSFML
 
   windows-arm64:
     name: Windows ARM64
-    runs-on: windows-2025
+    runs-on: windows-2025-vs2026
 
     steps:
       - name: Checkout SFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
 
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
       - name: Build SFML
         run: |
-          cmake -S SFML -B SFML-build -A ARM64 -G "Visual Studio 17 2022" -DBUILD_SHARED_LIBS=ON -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/SFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
+          cmake -S SFML -B SFML-build -A ARM64 -G "Visual Studio 18 2026" -DBUILD_SHARED_LIBS=ON -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/SFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
           cmake --build SFML-build --config Release --target install
 
       - name: Build CSFML
         run: |
-          cmake -S CSFML -B CSFML-build -A ARM64 -G "Visual Studio 17 2022" -DBUILD_SHARED_LIBS=ON -DCSFML_LINK_SFML_STATICALLY=OFF -DCMAKE_BUILD_TYPE=Release -DSFML_ROOT=${{ github.workspace }}/SFML-install -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/CSFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
+          cmake -S CSFML -B CSFML-build -A ARM64 -G "Visual Studio 18 2026" -DBUILD_SHARED_LIBS=ON -DCSFML_LINK_SFML_STATICALLY=OFF -DCMAKE_BUILD_TYPE=Release -DSFML_ROOT=${{ github.workspace }}/SFML-install -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/CSFML-install -DCMAKE_VERBOSE_MAKEFILE=ON
           cmake --build CSFML-build --config Release --target install
 
       - name: Move Files
@@ -225,7 +225,7 @@ jobs:
           Move-Item -Path "CSFML-install\*" -Destination "install\CSFML"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-windows-arm64
           path: install/CSFML
@@ -236,14 +236,14 @@ jobs:
 
     steps:
       - name: Checkout SFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
 
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
 
@@ -288,7 +288,7 @@ jobs:
           tar -zcvf CSFML-macOS-clang-64-bit.tar.gz CSFML-macOS-clang-64-bit
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-macOS-clang-64-bit
           path: CSFML-macOS-clang-64-bit.tar.gz
@@ -299,14 +299,14 @@ jobs:
 
     steps:
       - name: Checkout SFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
 
       - name: Checkout CSFML
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: CSFML
       - name: Build SFML
@@ -350,7 +350,7 @@ jobs:
           tar -zcvf CSFML-macOS-clang-arm64.tar.gz CSFML-macOS-clang-arm64
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: CSFML-macOS-clang-arm64
           path: CSFML-macOS-clang-arm64.tar.gz
diff --git a/tools/nuget/build.win.ps1 b/tools/nuget/build.win.ps1
index 178f0b21..33858675 100644
--- a/tools/nuget/build.win.ps1
+++ b/tools/nuget/build.win.ps1
@@ -17,7 +17,7 @@ if (-not $RID) {
     exit
 }
 
-$Generator = 'Visual Studio 17 2022'
+$Generator = 'Visual Studio 18 2026'
 
 # See also: https://learn.microsoft.com/en-us/dotnet/core/rid-catalog#known-rids
 switch ($RID) {

From f509dcf66cd6a6b25bcc03e3aa080a7c30b8c731 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lukas=20D=C3=BCrrenberger?= <eXpl0it3r@my-gate.net>
Date: Sat, 3 Oct 2026 12:48:03 +0200
Subject: [PATCH 2/3] Harden our GitHub Actions workflows

---
 .github/workflows/ci.yml      | 10 ++++++++++
 .github/workflows/nuget.yml   | 14 +++++++++++++-
 .github/workflows/release.yml | 12 ++++++++++++
 3 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6a6514cb..4e0a94f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,8 @@ name: CI
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions: {}
+
 concurrency:
   group: environment-${{github.ref}}
   cancel-in-progress: true
@@ -50,6 +52,7 @@ jobs:
     - name: Checkout SFML
       uses: actions/checkout@v7
       with:
+        persist-credentials: false
         repository: SFML/SFML
         ref: ${{env.SFML_VERSION}}
         path: SFML
@@ -68,6 +71,7 @@ jobs:
     - name: Checkout CSFML
       uses: actions/checkout@v7
       with:
+        persist-credentials: false
         path: CSFML
 
     - name: Configure CSFML CMake
@@ -97,6 +101,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@v7
+      with:
+        persist-credentials: false
 
     - name: Format Code
       run: cmake -DCLANG_FORMAT_EXECUTABLE=clang-format-17 -P cmake/Format.cmake
@@ -124,6 +130,7 @@ jobs:
     - name: Checkout SFML
       uses: actions/checkout@v7
       with:
+        persist-credentials: false
         repository: SFML/SFML
         ref: ${{env.SFML_VERSION}}
         path: SFML
@@ -137,6 +144,7 @@ jobs:
     - name: Checkout CSFML
       uses: actions/checkout@v7
       with:
+        persist-credentials: false
         path: CSFML
 
     - name: Configure CSFML CMake
@@ -164,6 +172,7 @@ jobs:
     - name: Checkout SFML
       uses: actions/checkout@v7
       with:
+        persist-credentials: false
         repository: SFML/SFML
         ref: ${{env.SFML_VERSION}}
         path: SFML
@@ -177,6 +186,7 @@ jobs:
     - name: Checkout CSFML
       uses: actions/checkout@v7
       with:
+        persist-credentials: false
         path: CSFML
 
     - name: Configure CSFML
diff --git a/.github/workflows/nuget.yml b/.github/workflows/nuget.yml
index 5143aa7b..3cebbb0a 100644
--- a/.github/workflows/nuget.yml
+++ b/.github/workflows/nuget.yml
@@ -9,6 +9,8 @@ on:
       - "**"
   workflow_dispatch: {}
 
+permissions: {}
+
 concurrency:
   group: nuget-${{github.ref}}
   cancel-in-progress: true
@@ -25,6 +27,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Build x86
@@ -53,6 +56,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Build ARM64
@@ -77,6 +81,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Build
@@ -100,6 +105,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Install dependencies & cross compiler
@@ -129,6 +135,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Install dependencies
@@ -159,6 +166,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Build
@@ -182,6 +190,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Install necessary tooling
@@ -218,6 +227,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
       - name: Download Artifacts
         uses: actions/download-artifact@v8
@@ -230,7 +240,9 @@ jobs:
         with:
           dotnet-version: 10.0.x
       - name: Enforce SDK Version
-        run: dotnet new globaljson --sdk-version ${{ steps.setup-dotnet.outputs.dotnet-version }} --force
+        env:
+          DOTNET_VERSION: ${{ steps.setup-dotnet.outputs.dotnet-version }}
+        run: dotnet new globaljson --sdk-version "$DOTNET_VERSION" --force
       - name: Verify SDK Installation
         run: dotnet --info
       - name: Build NuGet Package
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dbb081b6..9bb52954 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,8 @@ on:
       - "**"
   workflow_dispatch: {}
 
+permissions: {}
+
 concurrency:
   group: release-${{github.ref}}
   cancel-in-progress: true
@@ -43,6 +45,7 @@ jobs:
       - name: Checkout SFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
@@ -50,6 +53,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Build SFML
@@ -130,6 +134,7 @@ jobs:
       - name: Checkout SFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
@@ -137,6 +142,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Build SFML
@@ -199,6 +205,7 @@ jobs:
       - name: Checkout SFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
@@ -206,6 +213,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Build SFML
@@ -238,6 +246,7 @@ jobs:
       - name: Checkout SFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
@@ -245,6 +254,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
 
       - name: Build SFML
@@ -301,6 +311,7 @@ jobs:
       - name: Checkout SFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           repository: SFML/SFML
           ref: ${{ env.SFML_VERSION }}
           path: SFML
@@ -308,6 +319,7 @@ jobs:
       - name: Checkout CSFML
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           path: CSFML
       - name: Build SFML
         run: |

From cdf9df89b29ec76c4aff0d0cf1c9a856e546ade4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lukas=20D=C3=BCrrenberger?= <eXpl0it3r@my-gate.net>
Date: Sun, 4 Oct 2026 13:11:02 +0200
Subject: [PATCH 3/3] Disable ClangCL CI jobs and pin clang-tidy to LLVM 18

---
 .github/workflows/ci.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4e0a94f2..c627223a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,8 @@ jobs:
         platform:
         - { name: Windows VS2026 x86,  os: windows-2025-vs2026, flags: -AWin32 }
         - { name: Windows VS2026 x64,  os: windows-2025-vs2026, flags: -Ax64 }
-        - { name: Windows ClangCL,     os: windows-2025-vs2026, flags: -T ClangCL }
+        # ClangCL is disabled until we build against SFML 3.1, the FLAC version bundled with SFML 3.0 fails to compile with VS2026's ClangCL
+        # - { name: Windows ClangCL,     os: windows-2025-vs2026, flags: -T ClangCL }
         - { name: Windows Clang,       os: windows-2025-vs2026, flags: -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ }
         - { name: Linux GCC,           os: ubuntu-24.04, flags: -GNinja }
         - { name: Linux Clang,         os: ubuntu-24.04, flags: -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ }
@@ -124,8 +125,8 @@ jobs:
     - name: Install Dependencies
       run: |
         brew update
-        brew install llvm ninja
-        echo /opt/homebrew/opt/llvm/bin >> $GITHUB_PATH
+        brew install llvm@18 ninja
+        echo "$(brew --prefix llvm@18)/bin" >> $GITHUB_PATH
 
     - name: Checkout SFML
       uses: actions/checkout@v7