diff --git a/.github/workflows/abi-verify.yml b/.github/workflows/abi-verify.yml index 86fcc3f5..2a5d6130 100644 --- a/.github/workflows/abi-verify.yml +++ b/.github/workflows/abi-verify.yml @@ -48,7 +48,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build (typecheck) the ABI seam working-directory: src/abi @@ -70,7 +70,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build (typecheck) the formal package working-directory: src/formal @@ -86,7 +86,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build the parse front-end + test executable working-directory: idris2 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5f8867dc..c04c2a5b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -39,15 +39,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.0 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.0 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/coq-build.yml b/.github/workflows/coq-build.yml index 9dbdd782..88b5b74a 100644 --- a/.github/workflows/coq-build.yml +++ b/.github/workflows/coq-build.yml @@ -55,7 +55,7 @@ jobs: outputs: relevant: ${{ steps.f.outputs.relevant }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - id: f @@ -104,7 +104,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Coq 8.18 (noble apt) run: | diff --git a/.github/workflows/ffi-seams.yml b/.github/workflows/ffi-seams.yml index d30d3dca..2b5941a6 100644 --- a/.github/workflows/ffi-seams.yml +++ b/.github/workflows/ffi-seams.yml @@ -37,7 +37,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - id: detect @@ -68,10 +68,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Zig - uses: mlugg/setup-zig@v2.2.1 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 with: version: 0.15.2 diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 244e2397..e6b6f09a 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -24,7 +24,7 @@ jobs: - name: Trigger Propagation id: propagate if: ${{ env.FARM_DISPATCH_TOKEN != '' }} - uses: peter-evans/repository-dispatch@v4.0.1 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 env: FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }} with: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index c8b8a8db..421f349e 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -17,7 +17,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@v22 + uses: dawidd6/action-send-mail@67ce3558d613188179559c61d3565140cf389968 # v22 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 4ecfca67..00a00801 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -45,15 +45,17 @@ jobs: # for the in-tree codec that makes this possible. steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + with: + toolchain: v1 with: toolchain: stable # required when SHA-pinned (no rust-toolchain.toml in repo) - name: Cache cargo registry and build - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: no-default-features @@ -87,15 +89,15 @@ jobs: # known rustc-incremental ICE on ephapax-parser. steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 with: toolchain: stable # required when SHA-pinned (no rust-toolchain.toml in repo) - name: Cache cargo registry and build - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: wasm-validate diff --git a/.github/workflows/status-gate.yml b/.github/workflows/status-gate.yml index 2d17041e..11a14626 100644 --- a/.github/workflows/status-gate.yml +++ b/.github/workflows/status-gate.yml @@ -42,7 +42,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Proof-count drift (grep only — no build) run: ./scripts/status-gate.sh --proofs @@ -57,13 +57,15 @@ jobs: run: | echo "::notice title=Slow check — safe to cancel::status-gate-tests runs a full cargo build just to verify the TEST-NEEDS.md test count. The core proof-count gate (status-gate-core) is a separate, independent job and is already enforced. If you're in a rush you can cancel THIS job without letting any core gating go." - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + with: + toolchain: v1 with: toolchain: stable # required input when the action is SHA-pinned (the `stable` ref's default is not inherited by SHA) - name: Cache cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Test-count drift (full build — slow) env: CARGO_INCREMENTAL: "0"