Test apk and arch

.ci/docker-ci/arch/Dockerfile

@@ -1,4 +1,4 @@
-FROM archlinux:base-20220529.0.58327
+FROM archlinux/archlinux:base-20221113.0.102202
 
 LABEL maintainer="mail@sobolevn.me"
 LABEL vendor="git-secret team"

.github/workflows/build-man.yml

@@ -14,8 +14,11 @@ on:
       - '.github/workflows/build-man.yml'
   workflow_dispatch:
 
-concurrency: 
-  group: ${{ github.head_ref || github.run_id }}-build-man
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:

.github/workflows/github-pages.yml

@@ -9,13 +9,18 @@ on:
       - 'docs/**/*'
       - 'utils/*/install.sh'
 
-concurrency: 
-  group: ${{ github.head_ref || github.run_id }}
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
     - uses: actions/checkout@v6

.github/workflows/release-ci.yml

@@ -21,8 +21,11 @@ on:
       - 'Makefile'
       - '.github/workflows/release-ci.yml'
 
+permissions:
+  contents: read
+
 concurrency:
-  group: ${{ github.head_ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.head_ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
 
 jobs:
   release-packages:

.github/workflows/test.yml

@@ -11,8 +11,11 @@ on:
       - 'docs/**'
   workflow_dispatch:
 
-concurrency: 
-  group: ${{ github.head_ref || github.run_id }}-test
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 permissions:
@@ -34,7 +37,7 @@ jobs:
         docker-env:
           - alma
           - alpine
-          #- arch           # disable arch testing for now, see #916
+          - arch
           - debian-gnupg1  # We need to test legacy version of gnupg
           - debian-gnupg2
           - fedora