ci: pin GitHub Actions to commit SHAs, move Slack notifications to v4

.github/actions/build-docker-image/action.yml

@@ -45,7 +45,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         ref: ${{ inputs.ref }}
         fetch-depth: 0
@@ -94,7 +94,7 @@ runs:
         ${{inputs.dry_run}} || docker save "${DOCKER_IMAGE_NAME}" -o "${TAR_FILE}"
 
     - name: Upload Docker image artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ steps.create-tar-file.outputs.artifact_name }}
         path: ${{ env.TAR_FILE }}

.github/actions/cmd-in-docker/action.yml

@@ -57,7 +57,7 @@ runs:
     - name: Restore cache
       id: cache_restore
       if: ${{ inputs.use_cache == 'yes' }}
-      uses: WarpBuilds/cache/restore@v1
+      uses: WarpBuilds/cache/restore@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1.4.13
       with:
         path: |
           ~/.cargo/bin/
@@ -92,7 +92,7 @@ runs:
     - name: Clear cache before saving new version
       id: clear_cache
       if: ${{ inputs.use_cache == 'yes' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
-      uses: WarpBuilds/cache@v1
+      uses: WarpBuilds/cache@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1.4.13
       with:
         path: |
           ~/.cargo/bin/
@@ -107,7 +107,7 @@ runs:
     # Save cache key for default_branch triggered by merge into default_branch event ONLY
     - name: Save cache
       if: ${{ inputs.use_cache == 'yes' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && steps.clear_cache.outcome == 'success' }}
-      uses: WarpBuilds/cache/save@v1
+      uses: WarpBuilds/cache/save@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1.4.13
       with:
         path: |
           ~/.cargo/bin/

.github/workflows/CI-audit.yml

@@ -14,7 +14,7 @@ jobs:
     name: Cargo audit
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Cargo audit
         uses: ./.github/actions/cmd-in-docker
@@ -25,7 +25,7 @@ jobs:
 
       - name: Upload cargo audit output
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: audit-output
           path: audit_output.txt
@@ -41,16 +41,19 @@ jobs:
     if: ${{ failure() && !cancelled() && github.event_name == 'schedule' }}
     steps:
       - name: Send Slack notification
-        uses: slackapi/slack-github-action@v1.25.0
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          webhook: ${{ secrets.SLACK_WEBHOOK_ALERTS_ZKVERIFY }}
+          webhook-type: incoming-webhook
+          errors: true
           payload: |
             {
               "blocks": [
                 {
                   "type": "header",
                   "text": {
                     "type": "plain_text",
-                    "text": "🚨 ALERT - ${{ github.workflow }} Job Failed! 🚨"
+                    "text": "🚨 VFlow ALERT - ${{ github.workflow }} Job Failed! 🚨"
                   }
                 },
                 {
@@ -64,6 +67,3 @@ jobs:
                 }
               ]
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.QA_SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/CI-build-docker-image.yml

@@ -14,7 +14,7 @@ jobs:
     name: Build Docker image
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Docker build
         id: build-docker-image

.github/workflows/CI-build.yml

@@ -12,7 +12,7 @@ jobs:
     name: Build vflow-node
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: vflow-node build
         uses: ./.github/actions/cmd-in-docker
@@ -22,7 +22,7 @@ jobs:
           cache_key: 'build-vflow-node'
 
       - name: Upload vflow-node build binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: "vflow-node-bin"
           path: |

.github/workflows/CI-cache-cleanup.yaml

@@ -21,7 +21,7 @@ jobs:
           - unit-test
     steps:
       - name: "Deleting '${{ matrix.cache_key }}' cache key"
-        uses: WarpBuilds/cache@v1
+        uses: WarpBuilds/cache@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1.4.13
         with:
           path: |
             ~/.cargo/bin/

.github/workflows/CI-check-lockfile.yml

@@ -12,7 +12,7 @@ jobs:
     name: Check lockfile
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Check lockfile
         uses: ./.github/actions/cmd-in-docker

.github/workflows/CI-feature-propagation.yml

@@ -12,7 +12,7 @@ jobs:
     name: Feature propagation
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Features
         uses: ./.github/actions/cmd-in-docker
@@ -23,7 +23,7 @@ jobs:
 
       - name: Upload feature propagation output
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: feature-propagation-output
           path: features_output.txt

.github/workflows/CI-lint-format.yml

@@ -12,7 +12,7 @@ jobs:
     name: Lint and format
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Cargo lint
         uses: ./.github/actions/cmd-in-docker
@@ -24,7 +24,7 @@ jobs:
 
       - name: Upload lint artifacts
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: lint-output
           path: linting_output.txt
@@ -41,7 +41,7 @@ jobs:
 
       - name: Upload format artifacts
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: format-output
           path: formatting_output.txt
@@ -58,7 +58,7 @@ jobs:
 
       - name: Upload format Cargo.toml artifacts
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: format-toml-output
           path: formatting_tomls.txt

.github/workflows/CI-machete.yml

@@ -12,7 +12,7 @@ jobs:
     name: Machete
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run cargo machete
         uses: ./.github/actions/cmd-in-docker

.github/workflows/CI-release-runtime.yml

@@ -40,7 +40,7 @@ jobs:
       is-a-test-release: ${{ steps.check-requirements.outputs.TEST_RELEASE }}
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
@@ -65,7 +65,7 @@ jobs:
     needs: [ check-requirements ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Docker build
         id: build-docker-image
@@ -87,13 +87,13 @@ jobs:
     needs: [ build-docker ]
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
 
       - name: Download Docker runtime image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ needs.build-docker.outputs.artifact_name }}
           path: ./
@@ -111,7 +111,7 @@ jobs:
           "${GITHUB_WORKSPACE}/ci/extract_wasm.sh" --image-artifact ${{ needs.build-docker.outputs.artifact_name }}
 
       - name: Upload runtime artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: runtimes
           path: ./*.compact.compressed.wasm
@@ -124,21 +124,21 @@ jobs:
     needs: [ check-requirements, build-docker, extract-runtimes ]
     steps:
       - name: Retrieve Docker runtime image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ needs.build-docker.outputs.artifact_name }}
           path: docker-images/
 
       - name: Retrieve saved runtimes wasm
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: runtimes
           path: wasm
 
       - name: Create Release
         id: create-release
         if: ${{ needs.check-requirements.outputs.is-a-release == 'true' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ inputs.release_name }}
@@ -154,8 +154,14 @@ jobs:
 
       - name: Notify Slack Production Releases
         if: ${{ inputs.dry_run == false }}
-        uses: slackapi/slack-github-action@v1.25.0
+        # The release has already published at this point; a notification problem
+        # should be visible but must not red the job or skip what needs: it.
+        continue-on-error: true
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          webhook: ${{ secrets.RELEASES_PROD_SLACK_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
+          errors: true
           payload: |
             {
               "blocks": [
@@ -181,6 +187,3 @@ jobs:
                 }
               ]
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.RELEASES_PROD_SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/CI-release.yml

@@ -41,7 +41,7 @@ jobs:
       version-str: ${{ steps.check-requirements.outputs.VERSION_STR }}
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
@@ -66,7 +66,7 @@ jobs:
     needs: [ check-requirements ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Docker build
         id: build-docker-image
@@ -86,13 +86,13 @@ jobs:
     needs: [ check-requirements, build-docker ]
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
 
       - name: Download VFlow Docker image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ needs.build-docker.outputs.artifact_name }}
           path: ./
@@ -112,7 +112,7 @@ jobs:
           "${GITHUB_WORKSPACE}/ci/publish-docker-image.sh" --image-artifact ${{ needs.build-docker.outputs.artifact_name }}
 
       - name: Upload runtime artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: runtimes
           path: ./*.compact.compressed.wasm
@@ -125,15 +125,15 @@ jobs:
     needs: [ check-requirements, publish-docker-image ]
     steps:
       - name: Retrieve saved runtimes wasm
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: runtimes
           path: wasm
 
       - name: Create Release
         id: create-release
         if: ${{ needs.check-requirements.outputs.is-a-release == 'true' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ inputs.release_name }}
@@ -148,8 +148,14 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Notify Slack Production Releases
         if: ${{ inputs.dry_run == false }}
-        uses: slackapi/slack-github-action@v1.25.0
+        # The release has already published at this point; a notification problem
+        # should be visible but must not red the job or skip what needs: it.
+        continue-on-error: true
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          webhook: ${{ secrets.RELEASES_PROD_SLACK_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
+          errors: true
           payload: |
             {
               "blocks": [
@@ -182,6 +188,3 @@ jobs:
                 }
               ]
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.RELEASES_PROD_SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/CI-test-bench.yml

@@ -10,7 +10,7 @@ jobs:
     name: Build and run benchmarks
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: VFlow build with runtime-benchmarks
         uses: ./.github/actions/cmd-in-docker