From fe98eda1aabe6ca956b3b4fc1aafbfec156e211e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 23:04:47 +0000 Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@ # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins. --- .github/workflows/agda-meta-checker.yml | 6 ++-- .github/workflows/boj-build.yml | 2 +- .github/workflows/bridge-gate.yml | 2 +- .github/workflows/cargo-audit.yml | 6 ++-- .github/workflows/cflite_batch.yml | 4 +-- .github/workflows/cflite_pr.yml | 4 +-- .github/workflows/chapel-ci.yml | 30 ++++++++++--------- .github/workflows/codeql.yml | 6 ++-- .github/workflows/container-ci.yml | 4 +-- .github/workflows/dogfood-gate.yml | 12 ++++---- .github/workflows/dogfood-proofs-ci.yml | 10 +++---- .github/workflows/formal-verification.yml | 12 ++++---- .../generator-generic-ossf-slsa3-publish.yml | 2 +- .github/workflows/ghcr-publish.yml | 6 ++-- .github/workflows/idris2-abi-ci.yml | 2 +- .github/workflows/live-provers.yml | 30 ++++++++++--------- .github/workflows/mvp-smoke.yml | 10 ++++--- .github/workflows/pages.yml | 8 ++--- .github/workflows/proof-safety.yml | 4 +-- .github/workflows/rust-native-reusable.yml | 30 ++++++++++--------- .github/workflows/s4-loop.yml | 10 ++++--- .github/workflows/server-boot-gate.yml | 8 +++-- .../workflows/verification-proofs-cron.yml | 2 +- .github/workflows/workflow-linter.yml | 2 +- 24 files changed, 114 insertions(+), 98 deletions(-) diff --git a/.github/workflows/agda-meta-checker.yml b/.github/workflows/agda-meta-checker.yml index 70a5da04..64fb883c 100644 --- a/.github/workflows/agda-meta-checker.yml +++ b/.github/workflows/agda-meta-checker.yml @@ -36,7 +36,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Required-check shim: only the meta-checker/ tree needs the real proof # check. Non-PR events (push, workflow_dispatch) always run it. @@ -64,14 +64,14 @@ jobs: - name: Setup Haskell if: steps.detect.outputs.relevant == 'true' - uses: haskell-actions/setup@v2.12.0 + uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0 with: ghc-version: '9.6' cabal-version: '3.10' - name: Cache Agda if: steps.detect.outputs.relevant == 'true' - uses: actions/cache@v6.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cabal diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 1d269aa5..7b120d48 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -20,7 +20,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Trigger BoJ Server (Casket/ssg-mcp) run: | # Send a secure trigger to boj-server to build this repository diff --git a/.github/workflows/bridge-gate.yml b/.github/workflows/bridge-gate.yml index 63213b4f..3b338262 100644 --- a/.github/workflows/bridge-gate.yml +++ b/.github/workflows/bridge-gate.yml @@ -32,7 +32,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 25 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: B3 gate -- guix bumps (no network) env: diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml index b94dadf4..c5190ff6 100644 --- a/.github/workflows/cargo-audit.yml +++ b/.github/workflows/cargo-audit.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Detect Cargo.lock id: detect @@ -48,7 +48,9 @@ jobs: - name: Install Rust toolchain if: steps.detect.outputs.present == 'true' - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: master with: toolchain: stable diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index d42f9964..8973d4e7 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -22,14 +22,14 @@ jobs: steps: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/clusterfuzzlite/actions/build_fuzzers@v1 + uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: language: rust sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) id: run - uses: google/clusterfuzzlite/actions/run_fuzzers@v1 + uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} fuzz-seconds: 1800 diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index 98b9fe85..7cc59279 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -27,14 +27,14 @@ jobs: steps: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/clusterfuzzlite/actions/build_fuzzers@v1 + uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: language: rust sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) id: run - uses: google/clusterfuzzlite/actions/run_fuzzers@v1 + uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} fuzz-seconds: 300 diff --git a/.github/workflows/chapel-ci.yml b/.github/workflows/chapel-ci.yml index d2dfaec6..0cb573d9 100644 --- a/.github/workflows/chapel-ci.yml +++ b/.github/workflows/chapel-ci.yml @@ -62,7 +62,7 @@ jobs: runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb) run: | @@ -96,7 +96,7 @@ jobs: ./chapel_smoke - name: Upload Chapel library artifact - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: chapel-lib path: src/chapel/lib/libechidna_chapel* @@ -114,10 +114,10 @@ jobs: runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Zig - uses: mlugg/setup-zig@v2.2.1 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 with: version: 0.14.0 @@ -128,7 +128,7 @@ jobs: run: cd src/zig_ffi && zig build test - name: Upload FFI library artifact - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: chapel-ffi-lib path: src/zig_ffi/zig-out/lib/ @@ -145,18 +145,20 @@ jobs: needs: zig-ffi continue-on-error: true steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: master with: toolchain: stable - name: Rust cache - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Download FFI library - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: chapel-ffi-lib path: src/zig_ffi/zig-out/lib/ @@ -184,7 +186,7 @@ jobs: needs: [chapel-build, zig-ffi] continue-on-error: true steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb) run: | @@ -197,20 +199,20 @@ jobs: chpl --version - name: Install Zig - uses: mlugg/setup-zig@v2.2.1 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 with: version: 0.14.0 - name: Install Rust - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: toolchain: stable - name: Rust cache - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Download real Chapel library - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: chapel-lib path: src/chapel/ diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 80ce56a6..ad84cf14 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -41,15 +41,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.0 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.0 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index c1e101ce..cf4b0057 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -60,7 +60,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Podman run: | @@ -157,7 +157,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Podman run: | diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 30ee015b..8c49480d 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check for A2ML files id: detect @@ -76,7 +76,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check for K9 files id: detect @@ -122,7 +122,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Scan for invisible characters id: lint @@ -187,7 +187,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check for Groove manifest id: groove @@ -246,7 +246,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check and validate eclexiaiser manifest id: eclex @@ -318,7 +318,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/dogfood-proofs-ci.yml b/.github/workflows/dogfood-proofs-ci.yml index 16ef05e0..00c5f4a7 100644 --- a/.github/workflows/dogfood-proofs-ci.yml +++ b/.github/workflows/dogfood-proofs-ci.yml @@ -48,7 +48,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Coq run: | @@ -75,7 +75,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install elan + pinned Lean toolchain run: | @@ -127,7 +127,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install elan + pinned Lean toolchain run: | @@ -177,7 +177,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Idris2 run: | @@ -221,7 +221,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Agda + standard library run: | diff --git a/.github/workflows/formal-verification.yml b/.github/workflows/formal-verification.yml index d1e4cc60..231d5888 100644 --- a/.github/workflows/formal-verification.yml +++ b/.github/workflows/formal-verification.yml @@ -48,15 +48,17 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install stable Rust toolchain - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: master with: toolchain: stable - name: Cache Rust build artefacts - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: ". -> target" @@ -79,10 +81,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nightly Rust toolchain (Creusot pin) - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: # Pin matches crates/echidna-core-spark/rust-toolchain.toml. # Update both files together when bumping. diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 3ff3b460..ba671225 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -31,7 +31,7 @@ jobs: digests: ${{ steps.hash.outputs.digests }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # ======================================================== # diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml index d41787a0..6df42c1b 100644 --- a/.github/workflows/ghcr-publish.yml +++ b/.github/workflows/ghcr-publish.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nerdctl and containerd run: | @@ -91,14 +91,14 @@ jobs: # gh attest verify oci://ghcr.io/${{ github.repository }}: \ # --repo ${{ github.repository }} - name: Attest container provenance (minimal image) - uses: actions/attest-build-provenance@v4.2.2 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.push.outputs.min_digest }} push-to-registry: true - name: Attest container provenance (full image) - uses: actions/attest-build-provenance@v4.2.2 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.push.outputs.full_digest }} diff --git a/.github/workflows/idris2-abi-ci.yml b/.github/workflows/idris2-abi-ci.yml index 7fff30d0..1b491803 100644 --- a/.github/workflows/idris2-abi-ci.yml +++ b/.github/workflows/idris2-abi-ci.yml @@ -32,7 +32,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Required-check shim: decide whether ABI/proof sources actually changed. # The workflow file itself is intentionally NOT in the pattern, so CI-only diff --git a/.github/workflows/live-provers.yml b/.github/workflows/live-provers.yml index dfb2e8f6..313a9db2 100644 --- a/.github/workflows/live-provers.yml +++ b/.github/workflows/live-provers.yml @@ -75,15 +75,17 @@ jobs: - chuffed steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: master with: toolchain: stable - name: Cache Cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Provision prover (${{ matrix.backend }}) run: | @@ -136,7 +138,7 @@ jobs: continue-on-error: true steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Guix run: | sudo apt-get update -qq || sudo apt-get update -qq --fix-missing @@ -171,13 +173,13 @@ jobs: - tlaps steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: toolchain: stable - name: Cache Cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Provision ${{ matrix.backend }} (best-effort via apt / upstream release) continue-on-error: true run: | @@ -321,13 +323,13 @@ jobs: - imandra steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: toolchain: stable - name: Cache Cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Provision ${{ matrix.backend }} (best-effort) continue-on-error: true run: | @@ -425,7 +427,7 @@ jobs: continue-on-error: true steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Announce Wave-4 TODO run: | echo "Tier-4 backends (Mizar, Nuprl, PVS, Minlog, Dedukti, Arend, KeY, Prism, UPPAAL," @@ -451,13 +453,13 @@ jobs: - faial steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: toolchain: stable - name: Cache Cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Provision ${{ matrix.backend }} (best-effort, CUDA/OpenCL required) continue-on-error: true run: | diff --git a/.github/workflows/mvp-smoke.yml b/.github/workflows/mvp-smoke.yml index 116b611e..ef67b104 100644 --- a/.github/workflows/mvp-smoke.yml +++ b/.github/workflows/mvp-smoke.yml @@ -29,18 +29,20 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust toolchain - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: master with: toolchain: stable - name: Cache Cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Install just - uses: taiki-e/install-action@v2.87.13 + uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13 with: # Governance R1 requires versioned family-tool pins # (just|must|trust|adjust|bust|dust|intend); bare `tool: just` diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 55dff61c..28d24263 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -22,9 +22,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -38,7 +38,7 @@ jobs: mkdir -p _site/playground cp echidna-playground/index.html echidna-playground/styles.css _site/playground/ - name: Upload artifact - uses: actions/upload-pages-artifact@v5.0.0 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: '_site' deploy: @@ -51,4 +51,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5.0.1 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 diff --git a/.github/workflows/proof-safety.yml b/.github/workflows/proof-safety.yml index 80b8287d..e9d5cf25 100644 --- a/.github/workflows/proof-safety.yml +++ b/.github/workflows/proof-safety.yml @@ -16,10 +16,10 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 25 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: Swatinem/rust-cache@v2.9.2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Install required native provers run: | sudo apt-get update diff --git a/.github/workflows/rust-native-reusable.yml b/.github/workflows/rust-native-reusable.yml index d0cd78ac..9f15a51f 100644 --- a/.github/workflows/rust-native-reusable.yml +++ b/.github/workflows/rust-native-reusable.yml @@ -140,7 +140,7 @@ jobs: has_cargo: ${{ steps.detect.outputs.has_cargo }} steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} @@ -166,7 +166,7 @@ jobs: working-directory: ${{ inputs.working_directory }} steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} @@ -177,7 +177,9 @@ jobs: # `@stable`), but a SHA ref carries no version, so the action's "parse # toolchain version" step fails with `'toolchain' is a required input`. # See standards estate-wide rust-ci red. - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: master with: toolchain: stable components: clippy, rustfmt @@ -189,12 +191,12 @@ jobs: - name: Install Zig for native build if: ${{ inputs.zig_version != '' }} - uses: goto-bus-stop/setup-zig@v2.2.1 + uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1 with: version: ${{ inputs.zig_version }} - name: Cache cargo registry and build - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: ${{ inputs.working_directory }} @@ -224,14 +226,14 @@ jobs: working-directory: ${{ inputs.working_directory }} steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: toolchain: stable @@ -242,12 +244,12 @@ jobs: - name: Install Zig for native build if: ${{ inputs.zig_version != '' }} - uses: goto-bus-stop/setup-zig@v2.2.1 + uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1 with: version: ${{ inputs.zig_version }} - name: Cache cargo registry and build - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: ${{ inputs.working_directory }} @@ -278,14 +280,14 @@ jobs: working-directory: ${{ inputs.working_directory }} steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: toolchain: stable @@ -314,14 +316,14 @@ jobs: FLOOR: ${{ inputs.coverage_floor }} steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master with: toolchain: stable components: llvm-tools-preview @@ -333,7 +335,7 @@ jobs: - name: Install Zig for native build if: ${{ inputs.zig_version != '' }} - uses: goto-bus-stop/setup-zig@v2.2.1 + uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1 with: version: ${{ inputs.zig_version }} diff --git a/.github/workflows/s4-loop.yml b/.github/workflows/s4-loop.yml index 47efc071..de3460cf 100644 --- a/.github/workflows/s4-loop.yml +++ b/.github/workflows/s4-loop.yml @@ -33,15 +33,17 @@ jobs: VERISIM_URL: http://localhost:8080 steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust toolchain - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: master with: toolchain: stable - name: Cache Cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Install just - uses: taiki-e/install-action@v2.87.13 + uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13 with: tool: just@1.51.0 - name: Install system dependencies diff --git a/.github/workflows/server-boot-gate.yml b/.github/workflows/server-boot-gate.yml index 89365a95..bf6b033d 100644 --- a/.github/workflows/server-boot-gate.yml +++ b/.github/workflows/server-boot-gate.yml @@ -25,13 +25,15 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust toolchain - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + with: + toolchain: master with: toolchain: stable - name: Cache Cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Install system dependencies run: sudo apt-get install -y libssl-dev pkg-config - name: Build echidna binary diff --git a/.github/workflows/verification-proofs-cron.yml b/.github/workflows/verification-proofs-cron.yml index f224aea9..c19bba43 100644 --- a/.github/workflows/verification-proofs-cron.yml +++ b/.github/workflows/verification-proofs-cron.yml @@ -39,7 +39,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Isabelle run: | diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 546889ff..1afe124c 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check SPDX headers run: |