Add Windows Ninja Multi-Config build with sccache caching

.github/build.bat

@@ -4,9 +4,49 @@ REM
 REM SPDX-License-Identifier: MIT
 
 @echo off
+setlocal enabledelayedexpansion
+
+REM ---------------------------------------------------------------------------
+REM Optional shared compiler cache: sccache fronting Depot Cache (WebDAV).
+REM Mirrors build.sh's sccache_can_wrap_compiler() probe. Because sccache *is*
+REM the compiler launcher (cmake runs `sccache cl.exe ...` for every TU), a
+REM present-but-crashing sccache would red every build; so we trust it only after
+REM a trivial TU compiles *through* it. Enabled only when USE_CACHE=true AND
+REM sccache is on PATH AND the probe succeeds; otherwise the build proceeds
+REM uncached and green. The Visual Studio generator jobs do NOT set USE_CACHE, so
+REM this stays inert for them (and the VS generator ignores
+REM CMAKE_{C,CXX}_COMPILER_LAUNCHER anyway -- only Ninja/Makefiles honor it).
+REM ---------------------------------------------------------------------------
+set "LAUNCH="
+if /I "%USE_CACHE%"=="true" (
+    where sccache >nul 2>&1
+    if errorlevel 1 (
+        echo build.bat: USE_CACHE=true but sccache not on PATH; building WITHOUT cache.
+    ) else (
+        set "PROBE_DIR=%TEMP%\sccache-probe-%RANDOM%"
+        mkdir "!PROBE_DIR!" >nul 2>&1
+        (echo int sccache_probe_verify = 0;)> "!PROBE_DIR!\probe.c"
+        sccache cl.exe /nologo /c "!PROBE_DIR!\probe.c" /Fo"!PROBE_DIR!\probe.obj" > "!PROBE_DIR!\probe.log" 2>&1
+        if errorlevel 1 (
+            echo build.bat: sccache probe FAILED wrapping cl.exe -- building WITHOUT cache.
+            type "!PROBE_DIR!\probe.log"
+        ) else (
+            echo build.bat: sccache probe OK ^(wrapped cl.exe^).
+            set "LAUNCH=-DCMAKE_C_COMPILER_LAUNCHER=sccache -DCMAKE_CXX_COMPILER_LAUNCHER=sccache"
+        )
+        rmdir /s /q "!PROBE_DIR!" >nul 2>&1
+    )
+)
 
 mkdir build
-cmake -Bbuild %*
+cmake -Bbuild %LAUNCH% %*
+if errorlevel 1 exit /b %ERRORLEVEL%
 cmake --build build --config Release
+if errorlevel 1 exit /b %ERRORLEVEL%
 
-if errorlevel 1 exit /b %ERRORLEVEL%
+REM Only query stats when sccache was actually wired in as the launcher; re-invoking
+REM a rejected/crashing sccache here would just repeat its failure output.
+if defined LAUNCH (
+    echo build.bat: sccache --show-stats
+    sccache --show-stats
+)

.github/build.sh

@@ -19,18 +19,24 @@ fi
 # Fetch sccache when caching is requested but the runner/container doesn't ship it — the
 # dockcross cross-compile containers (manylinux/Android) and Linux hosts have no sccache,
 # while macOS installs it via brew in the workflow. Best-effort and inert-safe: any failure
-# leaves sccache absent, so the build just proceeds uncached. The static musl binary runs in
-# any x86_64 Linux container (the cross-compile host is always x86_64).
+# leaves sccache absent, so the build just proceeds uncached. A static musl release exists for
+# both Linux arches we build on: x86_64 (the dockcross cross-compile hosts) and aarch64 (the
+# native ubuntu-24.04-arm runner); any other arch leaves SCCACHE_DL_ARCH empty and is skipped.
 #
 # SCCACHE_DL_VERSION is overridable per-job, so a container that crashes one sccache build can
 # try another without editing this script (the in-container panic that stalled phase 2 was on
 # v0.8.2; v0.16.0 is the latest release and the default). A wrong/unavailable version just fails
 # the `curl -f` and falls back to an uncached build, so bumping it can never red a build.
 SCCACHE_DL_VERSION="${SCCACHE_DL_VERSION:-0.16.0}"
+case "$(uname -m)" in
+  x86_64)        SCCACHE_DL_ARCH="x86_64" ;;
+  aarch64|arm64) SCCACHE_DL_ARCH="aarch64" ;;
+  *)             SCCACHE_DL_ARCH="" ;;
+esac
 if [ "${USE_CACHE:-true}" = "true" ] && [ -n "${SCCACHE_WEBDAV_TOKEN:-}${SCCACHE_GHA_ENABLED:-}" ] \
    && ! command -v sccache >/dev/null 2>&1 \
-   && [ "$(uname -s)" = "Linux" ] && [ "$(uname -m)" = "x86_64" ]; then
-  SCCACHE_REL="sccache-v${SCCACHE_DL_VERSION}-x86_64-unknown-linux-musl"
+   && [ "$(uname -s)" = "Linux" ] && [ -n "$SCCACHE_DL_ARCH" ]; then
+  SCCACHE_REL="sccache-v${SCCACHE_DL_VERSION}-${SCCACHE_DL_ARCH}-unknown-linux-musl"
   echo "build.sh: fetching ${SCCACHE_REL} (no sccache on PATH)..."
   if curl -fsSL --proto =https --proto-redir =https \
         "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_DL_VERSION}/${SCCACHE_REL}.tar.gz" \

.github/workflows/clang-format.yml

@@ -23,7 +23,11 @@ jobs:
         with:
           python-version: "3.x"
       - name: Install pinned clang-format
-        run: pip install "clang-format==${CLANG_FORMAT_VERSION}"
+        # --only-binary :all: forces pip to install from a prebuilt wheel and never run a
+        # source package's setup.py at install time (SonarCloud GHA security rule). clang-format
+        # ships manylinux wheels, so this resolves normally on the ubuntu runner.
+        run: |
+          pip install --only-binary :all: "clang-format==${CLANG_FORMAT_VERSION}"
       - name: Check C++ formatting
         run: |
           clang-format --version

.github/workflows/osv-scanner.yml

@@ -13,7 +13,8 @@ on:
     - cron: '0 6 * * 1'
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan-scheduled: