ci: Pin third-party actions to commit SHAs and let Dependabot bump them

.github/actions/napi-addon/action.yml

@@ -31,13 +31,13 @@ runs:
 
     - name: Install Rust stable
       if: steps.napi-cache.outputs.cache-hit != 'true' || inputs.warm == 'true'
-      uses: dtolnay/rust-toolchain@v1
+      uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
       with:
         toolchain: stable
 
     # shared-key: without it the key includes the job id, so the cache main
     # saves from warm-caches.yml would never match the PR job in ci.yml.
-    - uses: Swatinem/rust-cache@v2
+    - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       id: rust-cache
       if: steps.napi-cache.outputs.cache-hit != 'true' || inputs.warm == 'true'
       with:
@@ -49,7 +49,7 @@ runs:
     # mold links the cdylib several times faster than ld.
     - name: Use mold linker
       if: (steps.napi-cache.outputs.cache-hit != 'true' || (inputs.warm == 'true' && steps.rust-cache.outputs.cache-hit != 'true')) && runner.os == 'Linux'
-      uses: rui314/setup-mold@v1
+      uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1
 
     # Warm mode builds on a dependency-cache miss so rust-cache's post step
     # saves a full target/, not just what a partial restore left.

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  # Actions are pinned to commit SHAs with the version in a trailing comment.
+  # Dependabot bumps both together in one grouped PR a week.
+  - package-ecosystem: github-actions
+    directories:
+      - "/"
+      - "/.github/actions/*"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: ci

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Check for Rust and JS/TS changes
         id: filter
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             rust:
@@ -117,7 +117,7 @@ jobs:
 
       - name: Install rustfmt
         if: ${{ !cancelled() && env.RUST == 'true' }}
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
         with:
           components: rustfmt
           toolchain: stable
@@ -170,7 +170,7 @@ jobs:
         # WebKit/GTK is needed to *dlopen* libtreq_lib.so in integration tests
         # even on a NAPI cache hit.
         if: env.RUN_TASK == 'true' && (matrix.platform == 'ubuntu-22.04' && matrix.task == 'test:integration')
-        uses: awalsh128/cache-apt-pkgs-action@v1.6.1
+        uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
           version: webkit-4.1-1
@@ -314,25 +314,27 @@ jobs:
       - uses: actions/checkout@v5
 
       - name: Install Rust stable
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
         with:
           components: rustfmt, clippy
           toolchain: stable
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@nextest
+        uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-nextest
 
       # mold links the large test binaries several times faster than ld.
       - name: Use mold linker
-        uses: rui314/setup-mold@v1
+        uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1
 
       # Cold apt install of WebKit/GTK is ~30–60s per job; restore from Actions
       # cache on subsequent runs. execute_install_scripts is required so dpkg
       # postinst (ldconfig, alternatives) still runs on restore.
       - name: install dependencies (ubuntu only)
         # WebKit/GTK is needed to *link* treq/tauri and to *dlopen*
         # libtreq_lib.so in tests.
-        uses: awalsh128/cache-apt-pkgs-action@v1.6.1
+        uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
           version: webkit-4.1-1
@@ -420,7 +422,7 @@ jobs:
       # Restores the cache warm-caches.yml saves on main. PR runs don't save:
       # a PR's cache can only be read by that PR, and the multi-GB saves
       # evict main's caches from the repo's 10 GB quota.
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: test
           save-if: ${{ github.ref == 'refs/heads/main' }}

.github/workflows/clean-pr-description.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Remove codex label
         if: github.event.action == 'opened'
-        uses: actions-ecosystem/action-remove-labels@v1
+        uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           labels: codex

.github/workflows/cli-binary.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@v5
       - name: Check for src-tauri changes
         id: filter
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             rust:
@@ -52,12 +52,12 @@ jobs:
           cache-dependency-path: package-lock.json
 
       - name: Install Rust stable
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
         with:
           toolchain: stable
 
       # The workspace root (not src-tauri/) owns target/.
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: cli-macos
           workspaces: |
@@ -95,7 +95,7 @@ jobs:
       - uses: actions/checkout@v5
 
       - name: Install Rust stable
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
         with:
           toolchain: stable
           targets: x86_64-unknown-linux-musl
@@ -105,7 +105,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y musl-tools
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           cache-on-failure: true
           workspaces: |

.github/workflows/deploy-supabase.yml

@@ -40,7 +40,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: supabase/setup-cli@v1
+      - uses: supabase/setup-cli@1dedf2c611547ede7232d26866dd3c56ab903bbb # v1.7.3
         with:
           version: latest
 

.github/workflows/deploy-web.yml

@@ -66,13 +66,13 @@ jobs:
 
       - name: Install Rust stable
         if: steps.napi-cache.outputs.cache-hit != 'true'
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
         with:
           toolchain: stable
 
       - name: Install WebKit GTK headers
         if: steps.napi-cache.outputs.cache-hit != 'true'
-        uses: awalsh128/cache-apt-pkgs-action@v1.6.1
+        uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
           version: webkit-4.1-1
@@ -81,7 +81,7 @@ jobs:
       - name: Install npm dependencies
         run: npm ci
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         if: steps.napi-cache.outputs.cache-hit != 'true'
         continue-on-error: true
         with:
@@ -176,7 +176,7 @@ jobs:
         run: npm run typecheck
       - name: Install uv
         if: ${{ !cancelled() && github.event_name == 'pull_request' }}
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       - name: Lint e2e tests (ast-grep)
         if: ${{ !cancelled() && github.event_name == 'pull_request' }}
         working-directory: ${{ github.workspace }}
@@ -216,7 +216,7 @@ jobs:
         run: bash scripts/ci-deploy-web-build.sh /tmp/landing-screenshots
       - name: Publish to Production
         if: github.event_name == 'release' || github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -225,7 +225,7 @@ jobs:
           gitHubToken: ${{ secrets.GITHUB_TOKEN }}
       - name: Publish Preview
         if: github.event_name == 'pull_request'
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

.github/workflows/mobile-gpui.yml

@@ -42,8 +42,10 @@ jobs:
     timeout-minutes: ${{ github.event_name == 'push' && 30 || 15 }}
     steps:
       - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: ./mobile-gpui -> target
           key: host
@@ -74,10 +76,11 @@ jobs:
         run: |
           sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/share/boost "$AGENT_TOOLSDIRECTORY"
           df -h /
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
         with:
+          toolchain: stable
           targets: aarch64-linux-android,x86_64-linux-android
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: ./mobile-gpui -> target
           key: android
@@ -86,7 +89,7 @@ jobs:
         with:
           distribution: temurin
           java-version: "17"
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
         with:
           packages: platform-tools
       - name: Install NDK
@@ -134,7 +137,7 @@ jobs:
           sudo udevadm trigger --name-match=kvm
       - name: Run on the emulator
         timeout-minutes: 15
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
         with:
           api-level: 34
           arch: x86_64

.github/workflows/mobile.yml

@@ -85,12 +85,12 @@ jobs:
 
       - name: Install Rust stable
         if: steps.secrets_check.outputs.configured == 'true'
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
         with:
           toolchain: stable
           targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         if: steps.secrets_check.outputs.configured == 'true'
         with:
           cache-on-failure: true
@@ -106,7 +106,7 @@ jobs:
 
       - name: Setup Android SDK/NDK
         if: steps.secrets_check.outputs.configured == 'true'
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
         with:
           packages: platform-tools
 
@@ -210,12 +210,12 @@ jobs:
 
       - name: Install Rust stable
         if: steps.secrets_check.outputs.configured == 'true'
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
         with:
           toolchain: stable
           targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         if: steps.secrets_check.outputs.configured == 'true'
         with:
           cache-on-failure: true