From 061bd2304b465e9eb627b5fd7cd1a4c6aba9f745 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 22:53:41 +0000 Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@ # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins. --- .github/workflows/abi-verify.yml | 6 +++--- .github/workflows/codeql.yml | 6 +++--- .github/workflows/coq-build.yml | 4 ++-- .github/workflows/ffi-seams.yml | 6 +++--- .github/workflows/instant-sync.yml | 2 +- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/rust-ci.yml | 14 ++++++++------ .github/workflows/status-gate.yml | 10 ++++++---- 8 files changed, 27 insertions(+), 23 deletions(-) diff --git a/.github/workflows/abi-verify.yml b/.github/workflows/abi-verify.yml index 86fcc3f5..2a5d6130 100644 --- a/.github/workflows/abi-verify.yml +++ b/.github/workflows/abi-verify.yml @@ -48,7 +48,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build (typecheck) the ABI seam working-directory: src/abi @@ -70,7 +70,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build (typecheck) the formal package working-directory: src/formal @@ -86,7 +86,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build the parse front-end + test executable working-directory: idris2 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5f8867dc..c04c2a5b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -39,15 +39,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.0 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.0 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/coq-build.yml b/.github/workflows/coq-build.yml index 9dbdd782..88b5b74a 100644 --- a/.github/workflows/coq-build.yml +++ b/.github/workflows/coq-build.yml @@ -55,7 +55,7 @@ jobs: outputs: relevant: ${{ steps.f.outputs.relevant }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - id: f @@ -104,7 +104,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Coq 8.18 (noble apt) run: | diff --git a/.github/workflows/ffi-seams.yml b/.github/workflows/ffi-seams.yml index d30d3dca..2b5941a6 100644 --- a/.github/workflows/ffi-seams.yml +++ b/.github/workflows/ffi-seams.yml @@ -37,7 +37,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - id: detect @@ -68,10 +68,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Zig - uses: mlugg/setup-zig@v2.2.1 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 with: version: 0.15.2 diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 244e2397..e6b6f09a 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -24,7 +24,7 @@ jobs: - name: Trigger Propagation id: propagate if: ${{ env.FARM_DISPATCH_TOKEN != '' }} - uses: peter-evans/repository-dispatch@v4.0.1 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 env: FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }} with: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index c8b8a8db..421f349e 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -17,7 +17,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@v22 + uses: dawidd6/action-send-mail@67ce3558d613188179559c61d3565140cf389968 # v22 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 4ecfca67..00a00801 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -45,15 +45,17 @@ jobs: # for the in-tree codec that makes this possible. steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + with: + toolchain: v1 with: toolchain: stable # required when SHA-pinned (no rust-toolchain.toml in repo) - name: Cache cargo registry and build - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: no-default-features @@ -87,15 +89,15 @@ jobs: # known rustc-incremental ICE on ephapax-parser. steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 with: toolchain: stable # required when SHA-pinned (no rust-toolchain.toml in repo) - name: Cache cargo registry and build - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: wasm-validate diff --git a/.github/workflows/status-gate.yml b/.github/workflows/status-gate.yml index 2d17041e..11a14626 100644 --- a/.github/workflows/status-gate.yml +++ b/.github/workflows/status-gate.yml @@ -42,7 +42,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Proof-count drift (grep only — no build) run: ./scripts/status-gate.sh --proofs @@ -57,13 +57,15 @@ jobs: run: | echo "::notice title=Slow check — safe to cancel::status-gate-tests runs a full cargo build just to verify the TEST-NEEDS.md test count. The core proof-count gate (status-gate-core) is a separate, independent job and is already enforced. If you're in a rush you can cancel THIS job without letting any core gating go." - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + with: + toolchain: v1 with: toolchain: stable # required input when the action is SHA-pinned (the `stable` ref's default is not inherited by SHA) - name: Cache cargo - uses: Swatinem/rust-cache@v2.9.2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Test-count drift (full build — slow) env: CARGO_INCREMENTAL: "0"