From 202d2346c406ce58e7e2698feb2249745ee20d9d Mon Sep 17 00:00:00 2001
From: arhag23 <35051569+arhag23@users.noreply.github.com>
Date: Mon, 20 Jul 2026 15:42:04 -0700
Subject: [PATCH] update actions/checkout to fix zizmor (#2327)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`zizmor` flags when a comment on a GitHub Actions third-party action
refers to the wrong git tag, and recently started failing like this:

```text
warning[ref-version-mismatch]: action's hash pin has mismatched or missing version comment
  --> .github/workflows/check-c-abi.yaml:12:75
   |
12 |         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
   |         ---------------------------------------------------------------   ^^ points to commit 11d5960a3267
   |         |
   |         is pointed to by tag v4.3.1
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#ref-version-mismatch
```

([build
link](https://github.com/NVIDIA/cuvs/actions/runs/29759754020/job/88411816429#step:7:277))

This fixes those references, to unblock CI.
---
 .github/workflows/check-c-abi.yaml           | 2 +-
 .github/workflows/publish-rust.yaml          | 2 +-
 .github/workflows/store-c-abi-baseline.yaml  | 2 +-
 .github/workflows/update-c-abi-baseline.yaml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check-c-abi.yaml b/.github/workflows/check-c-abi.yaml
index a594c48f44..3711da7baa 100644
--- a/.github/workflows/check-c-abi.yaml
+++ b/.github/workflows/check-c-abi.yaml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/publish-rust.yaml b/.github/workflows/publish-rust.yaml
index d702fd5375..8b21ff7a13 100644
--- a/.github/workflows/publish-rust.yaml
+++ b/.github/workflows/publish-rust.yaml
@@ -21,7 +21,7 @@ jobs:
     container:
       image: "rapidsai/ci-conda:26.08-cuda${{ matrix.cuda_version }}-ubuntu24.04-py3.13"
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
       - name: Check if release build
diff --git a/.github/workflows/store-c-abi-baseline.yaml b/.github/workflows/store-c-abi-baseline.yaml
index 9fb27dc56d..9b16020bd0 100644
--- a/.github/workflows/store-c-abi-baseline.yaml
+++ b/.github/workflows/store-c-abi-baseline.yaml
@@ -18,7 +18,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/update-c-abi-baseline.yaml b/.github/workflows/update-c-abi-baseline.yaml
index 893eec8832..171198329a 100644
--- a/.github/workflows/update-c-abi-baseline.yaml
+++ b/.github/workflows/update-c-abi-baseline.yaml
@@ -17,7 +17,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout main branch
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false