From 9fbafe8a94e4a7b9211ed612260a85d72c47ba70 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 06:14:36 +0000 Subject: [PATCH] ci: Pin third-party actions to commit SHAs and let Dependabot bump them A moved or compromised tag can no longer change what runs in CI. The branch refs dtolnay/rust-toolchain@stable and taiki-e/install-action@nextest become pinned tags with the equivalent toolchain and tool inputs. Dependabot opens one grouped github-actions PR a week. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01Uwdgq12RrXjifDLXargwye --- .github/actions/napi-addon/action.yml | 6 ++--- .github/dependabot.yml | 16 ++++++++++++ .github/workflows/ci.yml | 18 ++++++++------ .github/workflows/clean-pr-description.yml | 2 +- .github/workflows/cli-binary.yml | 10 ++++---- .github/workflows/deploy-supabase.yml | 2 +- .github/workflows/deploy-web.yml | 12 ++++----- .github/workflows/mobile-gpui.yml | 15 ++++++----- .github/workflows/mobile.yml | 10 ++++---- .github/workflows/nightly.yml | 29 +++++++++++++--------- .github/workflows/pgtap.yml | 2 +- .github/workflows/release.yml | 12 +++++---- .github/workflows/remote-e2e-cleanup.yml | 2 +- .github/workflows/remote-e2e.yml | 8 +++--- .github/workflows/remote-ssh-server-it.yml | 6 ++--- .github/workflows/warm-caches.yml | 22 +++++++++------- 16 files changed, 103 insertions(+), 69 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/actions/napi-addon/action.yml b/.github/actions/napi-addon/action.yml index e37912f57..6e0664818 100644 --- a/.github/actions/napi-addon/action.yml +++ b/.github/actions/napi-addon/action.yml @@ -31,13 +31,13 @@ runs: - name: Install Rust stable if: steps.napi-cache.outputs.cache-hit != 'true' || inputs.warm == 'true' - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: toolchain: stable # shared-key: without it the key includes the job id, so the cache main # saves from warm-caches.yml would never match the PR job in ci.yml. - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 id: rust-cache if: steps.napi-cache.outputs.cache-hit != 'true' || inputs.warm == 'true' with: @@ -49,7 +49,7 @@ runs: # mold links the cdylib several times faster than ld. - name: Use mold linker if: (steps.napi-cache.outputs.cache-hit != 'true' || (inputs.warm == 'true' && steps.rust-cache.outputs.cache-hit != 'true')) && runner.os == 'Linux' - uses: rui314/setup-mold@v1 + uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1 # Warm mode builds on a dependency-cache miss so rust-cache's post step # saves a full target/, not just what a partial restore left. diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..7fc779252 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 +updates: + # Actions are pinned to commit SHAs with the version in a trailing comment. + # Dependabot bumps both together in one grouped PR a week. + - package-ecosystem: github-actions + directories: + - "/" + - "/.github/actions/*" + schedule: + interval: weekly + groups: + github-actions: + patterns: + - "*" + commit-message: + prefix: ci diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 33f05bbc2..839453efa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Check for Rust and JS/TS changes id: filter - uses: dorny/paths-filter@v4 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 with: filters: | rust: @@ -117,7 +117,7 @@ jobs: - name: Install rustfmt if: ${{ !cancelled() && env.RUST == 'true' }} - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: components: rustfmt toolchain: stable @@ -170,7 +170,7 @@ jobs: # WebKit/GTK is needed to *dlopen* libtreq_lib.so in integration tests # even on a NAPI cache hit. if: env.RUN_TASK == 'true' && (matrix.platform == 'ubuntu-22.04' && matrix.task == 'test:integration') - uses: awalsh128/cache-apt-pkgs-action@v1.6.1 + uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1 with: packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf version: webkit-4.1-1 @@ -314,17 +314,19 @@ jobs: - uses: actions/checkout@v5 - name: Install Rust stable - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: components: rustfmt, clippy toolchain: stable - name: Install cargo-nextest - uses: taiki-e/install-action@nextest + uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28 + with: + tool: cargo-nextest # mold links the large test binaries several times faster than ld. - name: Use mold linker - uses: rui314/setup-mold@v1 + uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1 # Cold apt install of WebKit/GTK is ~30–60s per job; restore from Actions # cache on subsequent runs. execute_install_scripts is required so dpkg @@ -332,7 +334,7 @@ jobs: - name: install dependencies (ubuntu only) # WebKit/GTK is needed to *link* treq/tauri and to *dlopen* # libtreq_lib.so in tests. - uses: awalsh128/cache-apt-pkgs-action@v1.6.1 + uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1 with: packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf version: webkit-4.1-1 @@ -420,7 +422,7 @@ jobs: # Restores the cache warm-caches.yml saves on main. PR runs don't save: # a PR's cache can only be read by that PR, and the multi-GB saves # evict main's caches from the repo's 10 GB quota. - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: test save-if: ${{ github.ref == 'refs/heads/main' }} diff --git a/.github/workflows/clean-pr-description.yml b/.github/workflows/clean-pr-description.yml index f7634af7f..987b7d0ae 100644 --- a/.github/workflows/clean-pr-description.yml +++ b/.github/workflows/clean-pr-description.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Remove codex label if: github.event.action == 'opened' - uses: actions-ecosystem/action-remove-labels@v1 + uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} labels: codex diff --git a/.github/workflows/cli-binary.yml b/.github/workflows/cli-binary.yml index fb261610b..b2deeb4e4 100644 --- a/.github/workflows/cli-binary.yml +++ b/.github/workflows/cli-binary.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@v5 - name: Check for src-tauri changes id: filter - uses: dorny/paths-filter@v4 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 with: filters: | rust: @@ -52,12 +52,12 @@ jobs: cache-dependency-path: package-lock.json - name: Install Rust stable - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: toolchain: stable # The workspace root (not src-tauri/) owns target/. - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: cli-macos workspaces: | @@ -95,7 +95,7 @@ jobs: - uses: actions/checkout@v5 - name: Install Rust stable - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: toolchain: stable targets: x86_64-unknown-linux-musl @@ -105,7 +105,7 @@ jobs: sudo apt-get update sudo apt-get install -y musl-tools - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true workspaces: | diff --git a/.github/workflows/deploy-supabase.yml b/.github/workflows/deploy-supabase.yml index 5a10281c4..12e246052 100644 --- a/.github/workflows/deploy-supabase.yml +++ b/.github/workflows/deploy-supabase.yml @@ -40,7 +40,7 @@ jobs: steps: - uses: actions/checkout@v5 - - uses: supabase/setup-cli@v1 + - uses: supabase/setup-cli@1dedf2c611547ede7232d26866dd3c56ab903bbb # v1.7.3 with: version: latest diff --git a/.github/workflows/deploy-web.yml b/.github/workflows/deploy-web.yml index 38aa0e5c5..2e77e3910 100644 --- a/.github/workflows/deploy-web.yml +++ b/.github/workflows/deploy-web.yml @@ -66,13 +66,13 @@ jobs: - name: Install Rust stable if: steps.napi-cache.outputs.cache-hit != 'true' - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: toolchain: stable - name: Install WebKit GTK headers if: steps.napi-cache.outputs.cache-hit != 'true' - uses: awalsh128/cache-apt-pkgs-action@v1.6.1 + uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1 with: packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf version: webkit-4.1-1 @@ -81,7 +81,7 @@ jobs: - name: Install npm dependencies run: npm ci - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 if: steps.napi-cache.outputs.cache-hit != 'true' continue-on-error: true with: @@ -176,7 +176,7 @@ jobs: run: npm run typecheck - name: Install uv if: ${{ !cancelled() && github.event_name == 'pull_request' }} - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 - name: Lint e2e tests (ast-grep) if: ${{ !cancelled() && github.event_name == 'pull_request' }} working-directory: ${{ github.workspace }} @@ -216,7 +216,7 @@ jobs: run: bash scripts/ci-deploy-web-build.sh /tmp/landing-screenshots - name: Publish to Production if: github.event_name == 'release' || github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/main') - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} @@ -225,7 +225,7 @@ jobs: gitHubToken: ${{ secrets.GITHUB_TOKEN }} - name: Publish Preview if: github.event_name == 'pull_request' - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} diff --git a/.github/workflows/mobile-gpui.yml b/.github/workflows/mobile-gpui.yml index 14ee187cd..639431f03 100644 --- a/.github/workflows/mobile-gpui.yml +++ b/.github/workflows/mobile-gpui.yml @@ -42,8 +42,10 @@ jobs: timeout-minutes: ${{ github.event_name == 'push' && 30 || 15 }} steps: - uses: actions/checkout@v5 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@v2 + - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 + with: + toolchain: stable + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: ./mobile-gpui -> target key: host @@ -74,10 +76,11 @@ jobs: run: | sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/share/boost "$AGENT_TOOLSDIRECTORY" df -h / - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: + toolchain: stable targets: aarch64-linux-android,x86_64-linux-android - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: ./mobile-gpui -> target key: android @@ -86,7 +89,7 @@ jobs: with: distribution: temurin java-version: "17" - - uses: android-actions/setup-android@v3 + - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2 with: packages: platform-tools - name: Install NDK @@ -134,7 +137,7 @@ jobs: sudo udevadm trigger --name-match=kvm - name: Run on the emulator timeout-minutes: 15 - uses: reactivecircus/android-emulator-runner@v2 + uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0 with: api-level: 34 arch: x86_64 diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml index 4e601d161..59c4aa507 100644 --- a/.github/workflows/mobile.yml +++ b/.github/workflows/mobile.yml @@ -85,12 +85,12 @@ jobs: - name: Install Rust stable if: steps.secrets_check.outputs.configured == 'true' - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: toolchain: stable targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 if: steps.secrets_check.outputs.configured == 'true' with: cache-on-failure: true @@ -106,7 +106,7 @@ jobs: - name: Setup Android SDK/NDK if: steps.secrets_check.outputs.configured == 'true' - uses: android-actions/setup-android@v3 + uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2 with: packages: platform-tools @@ -210,12 +210,12 @@ jobs: - name: Install Rust stable if: steps.secrets_check.outputs.configured == 'true' - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: toolchain: stable targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 if: steps.secrets_check.outputs.configured == 'true' with: cache-on-failure: true diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 7359a0b9b..c63ac5820 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -94,8 +94,9 @@ jobs: cache: "npm" - name: install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: + toolchain: stable targets: ${{ matrix.target }} - name: install dependencies (ubuntu only) @@ -104,7 +105,7 @@ jobs: sudo apt-get update sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true workspaces: ". -> target" @@ -121,7 +122,7 @@ jobs: grep -qx 'crate-type = \["rlib"\]' src-tauri/Cargo.toml rm src-tauri/Cargo.toml.bak - - uses: tauri-apps/tauri-action@v0 + - uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2 env: # Nightlies trade a slightly larger binary for a much faster link. # Cargo.toml's release profile (fat LTO, 1 codegen unit) is kept @@ -178,11 +179,12 @@ jobs: df -h / - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: + toolchain: stable targets: aarch64-linux-android - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true key: nightly-android @@ -195,7 +197,7 @@ jobs: java-version: "17" - name: Setup Android SDK - uses: android-actions/setup-android@v3 + uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2 with: packages: platform-tools @@ -258,11 +260,12 @@ jobs: - uses: actions/checkout@v5 - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: + toolchain: stable targets: aarch64-apple-ios,aarch64-apple-ios-sim - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true key: nightly-ios @@ -347,13 +350,15 @@ jobs: cache-dependency-path: package-lock.json - name: Install Rust stable - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: components: rustfmt toolchain: stable - name: Install cargo-nextest - uses: taiki-e/install-action@nextest + uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28 + with: + tool: cargo-nextest # windows-latest runners ship LLVM (lld-link.exe) but link.exe from MSVC # is the default; switch to lld for a much faster linker on Windows. @@ -362,7 +367,7 @@ jobs: echo "RUSTFLAGS=-C linker=lld-link" >> "$GITHUB_ENV" - name: Setup sccache - uses: mozilla-actions/sccache-action@v0.0.9 + uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9 - name: Configure sccache run: | @@ -428,7 +433,7 @@ jobs: - name: Install dependencies run: npm ci - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true workspaces: | diff --git a/.github/workflows/pgtap.yml b/.github/workflows/pgtap.yml index 638490a70..2f292afe1 100644 --- a/.github/workflows/pgtap.yml +++ b/.github/workflows/pgtap.yml @@ -25,7 +25,7 @@ jobs: steps: - uses: actions/checkout@v5 - - uses: supabase/setup-cli@v1 + - uses: supabase/setup-cli@1dedf2c611547ede7232d26866dd3c56ab903bbb # v1.7.3 with: version: latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e07e61330..5f33f60b4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -74,8 +74,9 @@ jobs: cache: "npm" - name: install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: + toolchain: stable targets: ${{ matrix.target }} - name: install dependencies (ubuntu only) @@ -84,7 +85,7 @@ jobs: sudo apt-get update sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true workspaces: ". -> target" @@ -127,7 +128,7 @@ jobs: grep -qx 'crate-type = \["rlib"\]' src-tauri/Cargo.toml rm src-tauri/Cargo.toml.bak - - uses: tauri-apps/tauri-action@v0 + - uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} @@ -172,8 +173,9 @@ jobs: - uses: actions/checkout@v5 - name: install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: + toolchain: stable targets: ${{ matrix.target }} - name: install musl @@ -181,7 +183,7 @@ jobs: sudo apt-get update sudo apt-get install -y musl-tools - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true workspaces: ". -> target" diff --git a/.github/workflows/remote-e2e-cleanup.yml b/.github/workflows/remote-e2e-cleanup.yml index 476c8330a..c3839ab61 100644 --- a/.github/workflows/remote-e2e-cleanup.yml +++ b/.github/workflows/remote-e2e-cleanup.yml @@ -25,7 +25,7 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v5 - - uses: denoland/setup-deno@v2 + - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 with: deno-version: v2.x - name: Unit tests against fixtures (no provider) diff --git a/.github/workflows/remote-e2e.yml b/.github/workflows/remote-e2e.yml index b42c7a18f..5ce681bda 100644 --- a/.github/workflows/remote-e2e.yml +++ b/.github/workflows/remote-e2e.yml @@ -50,18 +50,20 @@ jobs: else echo "run=true" >> "$GITHUB_OUTPUT" fi - - uses: denoland/setup-deno@v2 + - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 if: steps.gate.outputs.run == 'true' with: deno-version: v2.x - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 if: steps.gate.outputs.run == 'true' + with: + toolchain: stable - name: Install Linux build dependencies if: steps.gate.outputs.run == 'true' run: | sudo apt-get update sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 if: steps.gate.outputs.run == 'true' with: cache-on-failure: true diff --git a/.github/workflows/remote-ssh-server-it.yml b/.github/workflows/remote-ssh-server-it.yml index b180152ab..f8cfc2a3f 100644 --- a/.github/workflows/remote-ssh-server-it.yml +++ b/.github/workflows/remote-ssh-server-it.yml @@ -243,11 +243,11 @@ jobs: ssh "${ssh_opts[@]}" 'treq --version' - name: Install Rust stable - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: toolchain: stable - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true workspaces: | @@ -256,7 +256,7 @@ jobs: # Needed to link `treq` at all (see ci.yml's identical step) - not # needed to run it, since the real binary never leaves this runner. - name: install dependencies (ubuntu only) - uses: awalsh128/cache-apt-pkgs-action@v1.6.1 + uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1 with: packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf version: webkit-4.1-1 diff --git a/.github/workflows/warm-caches.yml b/.github/workflows/warm-caches.yml index af8c3508e..5a897ce73 100644 --- a/.github/workflows/warm-caches.yml +++ b/.github/workflows/warm-caches.yml @@ -57,7 +57,7 @@ jobs: cache-dependency-path: package-lock.json - name: install dependencies (ubuntu only) - uses: awalsh128/cache-apt-pkgs-action@v1.6.1 + uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1 with: packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf version: webkit-4.1-1 @@ -83,25 +83,27 @@ jobs: - uses: actions/checkout@v5 - name: Install Rust stable - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: components: rustfmt, clippy toolchain: stable - name: Install cargo-nextest - uses: taiki-e/install-action@nextest + uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28 + with: + tool: cargo-nextest - name: Use mold linker - uses: rui314/setup-mold@v1 + uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1 - name: install dependencies (ubuntu only) - uses: awalsh128/cache-apt-pkgs-action@v1.6.1 + uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1 with: packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf version: webkit-4.1-1 execute_install_scripts: true - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: test workspaces: | @@ -129,12 +131,14 @@ jobs: - uses: actions/checkout@v5 - name: Install Rust stable - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 with: toolchain: stable - name: Install cargo-nextest - uses: taiki-e/install-action@nextest + uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28 + with: + tool: cargo-nextest - name: Resolve jj release tag id: jj @@ -182,7 +186,7 @@ jobs: - name: Add jj to PATH run: echo "$GITHUB_WORKSPACE/.ci-bin" >> "$GITHUB_PATH" - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: test workspaces: |