ci(security): pin workflow actions by digest

[sethkarten]

Summary

• pin every GitHub Action used by the build, CI, and nightly workflows to an immutable commit digest
• disable persisted checkout credentials in every checkout step
• preserve the existing least-privilege workflow and job permissions, including the release job's required contents: write

Fixes #926.

Risk

Low. This is limited to workflow references and checkout credential persistence. Action major versions and inputs are unchanged. The release job retains only the write permission required to create and update releases and tags.

Provenance

Extracted directly onto current main from the independently authored security work in #1159. The commit preserves the original source SHA with a cherry picked from trailer. No changes were taken from the MCP/provider stack.

Validation

• npm run check
• parsed all changed workflow YAML successfully
• verified all 14 uses: references are pinned to full 40-character SHA-1 values
• verified all 6 checkout steps use persist-credentials: false
• verified each pinned digest against its upstream action tag with git ls-remote
• git diff --check origin/main...HEAD

Review focus

Please verify the pinned action identities, checkout credential handling, and the intentionally narrow contents: write permission on the publish job.

---

Note

^{Cursor Bugbot is generating a summary for commit f86d5be. Configure here.}

Note

Pin CI workflow actions to specific commit digests

• Pins all GitHub Actions in build-binaries.yml, ci.yml, and nightly-process-stress.yml to immutable commit SHAs instead of mutable version tags.
• Adds persist-credentials: false to all actions/checkout steps, preventing Git credentials from being stored in the local repository after checkout.

^{Macroscope summarized f86d5be.}

[Apocrathia]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: f86d5be998

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Apocrathia]

All hashes are valid and link to a known commit.

[jonaowen]

All executable third-party action references in the three touched workflows are immutable full SHAs, and I independently verified each advertised tag currently resolves to the pinned commit (checkout v7.0.0, setup-node v7.0.0, upload-artifact v7, download-artifact v8). Disabling checkout credential persistence further narrows authority. I found no blocker at exact head f86d5be998987ba73f6898a1697c4f8454269579.