ci: update actions, pin actions by sha, and apply zizmor fixes, and update to ubuntu 26.04

.github/actions/install-go/action.yml

@@ -3,14 +3,14 @@ description: "Reusable action to install Go, so there is one place to bump Go ve
 inputs:
   go-version:
     required: true
-    default: "1.24.3"
+    default: "1.24.x"
     description: "Go version to install"
 
 runs:
   using: composite
   steps:
     - name: "Setup Go"
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ inputs.go-version }}
         cache: false # see actions/setup-go#368

.github/workflows/ci.yml

@@ -9,11 +9,15 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
 
   checks:
     name: Project Checks
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
 
     steps:
@@ -24,30 +28,29 @@ jobs:
           echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
           echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: src/github.com/containerd/nri
           fetch-depth: 25
+          persist-credentials: false
 
-      - uses: ./src/github.com/containerd/nri/.github/actions/install-go
+      - uses: $/.github/actions/install-go
 
-      - uses: containerd/project-checks@v1.2.2
+      - uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4 # v1.2.2
         with:
           working-directory: src/github.com/containerd/nri
 
   test-build:
     name: Check buildability
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/install-go
-
-      # needed for wasm plugins
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          go-version-file: go.mod
+          persist-credentials: false
+
+      - uses: $/.github/actions/install-go
 
       - name: Set env
         shell: bash
@@ -78,11 +81,14 @@ jobs:
     strategy:
       matrix:
         go-version: ["1.24.x"]
-        os: [ubuntu-22.04]
+        os: [ubuntu-26.04]
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/install-go
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: $/.github/actions/install-go
         with:
           go-version: ${{ matrix.go-version }}
 
@@ -91,22 +97,25 @@ jobs:
         run: |
           echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
 
-      - uses: golangci/golangci-lint-action@v8
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.4
+          version: v2.12
 
   tests:
     name: Tests
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
 
     strategy:
       matrix:
         go-version: ["1.24.x"]
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/install-go
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: $/.github/actions/install-go
         with:
           go-version: ${{ matrix.go-version }}
 

.github/workflows/codeql.yml

@@ -2,15 +2,17 @@ name: "CodeQL Scan"
 
 on:
   push:
-    branches:
-      - main
+    branches: [ main ]
   pull_request:
-    branches:
-      - main
+    branches: [ main ]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   CodeQL-Build:
     if: github.repository == 'containerd/nri'
@@ -19,20 +21,20 @@ jobs:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/analyze to upload SARIF results
 
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
 
     timeout-minutes: 30
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          go-version-file: go.mod
+          persist-credentials: false
+
+      - uses: $/.github/actions/install-go
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
 
       - name: Install protoc and plugins
         run: |
@@ -42,4 +44,4 @@ jobs:
       - run: make
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/codespell.yml

@@ -9,13 +9,19 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   codespell:
     name: Check for spelling errors
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Codespell
-        uses: codespell-project/actions-codespell@v2
+        uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2

.github/workflows/images.yml

@@ -2,19 +2,18 @@ name: Publish Container Images
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
     tags:
       - v[0-9]+.[0-9]+.[0-9]+
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   build-and-push:
     name: Build and Push (${{ matrix.image }})
@@ -38,20 +37,22 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: 'v2.5.3'
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to registry
         if: github.event_name == 'push'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -60,13 +61,13 @@ jobs:
       - name: Determine image tag name
         id: tag
         run: |
-          if [ "${{ github.ref_type }}" = "tag" ]; then
-              tag="${{ github.ref_name }}"
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+              tag="${GITHUB_REF_NAME}"
           else
               if [ "${{ github.event_name }}" = "pull_request" ]; then
                   tag="pr-${{ github.event.pull_request.number }}"
               else
-                  case "${{ github.ref_name }}" in
+                  case "${GITHUB_REF_NAME}" in
                       main)
                           tag="unstable"
                           ;;
@@ -81,7 +82,7 @@ jobs:
 
       - name: Build and push image
         id: build-and-push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./plugins/Dockerfile