From 57f11ddbeddbefb51b084818a37eb490f6b23a95 Mon Sep 17 00:00:00 2001
From: gaebal-gajae <clawdbot@users.noreply.github.com>
Date: Mon, 12 Oct 2026 22:05:06 +0000
Subject: [PATCH] ci: pin all third-party GitHub Actions to immutable commit
 SHAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- actions/checkout: v4 → 11d5960a326750d5838078e36cf38b85af677262
- actions/setup-python: v5 → a26af69be951a213d495a4c3e4e4022e16d87065
- actions/upload-artifact: v4 → ea165f8d65b6e75b540449e92b4886f43607fa02
- dtolnay/rust-toolchain: stable → 686976e191b89faba57d3206551f0f330d8cb249
- Swatinem/rust-cache: v2 → 49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c
- softprops/action-gh-release: v2 → 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65

Improves supply chain security by pinning Actions to specific commits
instead of mutable tag references, preventing unexpected behavior changes
if action maintainers update tags.

Fixes #3287
---
 .github/workflows/release.yml | 10 +++++-----
 .github/workflows/rust-ci.yml | 28 ++++++++++++++--------------
 .github/workflows/rust.yml    |  2 +-
 3 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c1a1d942..60b08d3e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,11 +40,11 @@ jobs:
       run:
         working-directory: rust
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c
         with:
           workspaces: rust -> target
 
@@ -60,7 +60,7 @@ jobs:
           (cd dist && sha256sum "${{ matrix.artifact_name }}" > "${{ matrix.artifact_name }}.sha256")
 
       - name: Upload workflow artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: ${{ matrix.artifact_name }}
           path: |
@@ -69,7 +69,7 @@ jobs:
 
       - name: Upload release asset
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65
         with:
           files: |
             rust/dist/${{ matrix.artifact_name }}
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index e41d95cb..963b1874 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -68,8 +68,8 @@ jobs:
       run:
         working-directory: .
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.x"
       - name: Check docs and metadata for stale branding
@@ -85,11 +85,11 @@ jobs:
     name: cargo fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249
         with:
           components: rustfmt
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c
         with:
           workspaces: rust -> target
       - name: Check formatting
@@ -99,9 +99,9 @@ jobs:
     name: cargo test --workspace
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c
         with:
           workspaces: rust -> target
       - name: Run workspace tests
@@ -111,11 +111,11 @@ jobs:
     name: cargo clippy --workspace
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c
         with:
           workspaces: rust -> target
       - name: Run workspace clippy
@@ -129,9 +129,9 @@ jobs:
         working-directory: rust
         shell: pwsh
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c
         with:
           workspaces: rust -> target
       - name: Build CLI for Windows smoke
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index a17f3387..62812876 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
     - name: Build
       run: cargo build --verbose
     - name: Run tests