diff --git a/.github/workflows/bridge-gate.yml b/.github/workflows/bridge-gate.yml index 3d67240..41498ca 100644 --- a/.github/workflows/bridge-gate.yml +++ b/.github/workflows/bridge-gate.yml @@ -31,7 +31,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 25 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: B3 gate -- nix bumps (no network) env: diff --git a/.github/workflows/build-validation.yml b/.github/workflows/build-validation.yml index 97cf355..1e355e2 100644 --- a/.github/workflows/build-validation.yml +++ b/.github/workflows/build-validation.yml @@ -18,8 +18,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + with: + toolchain: stable - run: cargo check --workspace validate-elixir: @@ -30,8 +32,8 @@ jobs: run: working-directory: elixir-orchestration steps: - - uses: actions/checkout@v7.0.1 - - uses: erlef/setup-beam@v1.24.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: elixir-version: "1.17" otp-version: "27" diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index 25e5ce1..d823a9c 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -27,14 +27,14 @@ jobs: steps: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/clusterfuzzlite/actions/build_fuzzers@v1 + uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: language: rust sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) id: run - uses: google/clusterfuzzlite/actions/run_fuzzers@v1 + uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} fuzz-seconds: 1800 diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index 308d584..a607ceb 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -24,14 +24,14 @@ jobs: steps: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/clusterfuzzlite/actions/build_fuzzers@v1 + uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: language: rust sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) id: run - uses: google/clusterfuzzlite/actions/run_fuzzers@v1 + uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} fuzz-seconds: 300 diff --git a/.github/workflows/coq-build.yml b/.github/workflows/coq-build.yml index 4c492ec..ebc8d40 100644 --- a/.github/workflows/coq-build.yml +++ b/.github/workflows/coq-build.yml @@ -34,7 +34,7 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Coq run: | diff --git a/.github/workflows/doc-consonance.yml b/.github/workflows/doc-consonance.yml index 254b852..6f3e71a 100644 --- a/.github/workflows/doc-consonance.yml +++ b/.github/workflows/doc-consonance.yml @@ -16,6 +16,6 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Doc-consonance gate (no query-language misnomer in docs) run: bash tests/doc-consonance-gate.sh diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index c658505..80b34bb 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -28,7 +28,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check for A2ML files id: detect diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml index 68bcf9c..621b7ce 100644 --- a/.github/workflows/elixir-ci.yml +++ b/.github/workflows/elixir-ci.yml @@ -44,7 +44,7 @@ jobs: - elixir: "1.17" otp: "27" steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Detect relevant changes id: detect working-directory: ${{ github.workspace }} @@ -64,12 +64,12 @@ jobs: echo "relevant=true" >> "$GITHUB_OUTPUT" fi - if: steps.detect.outputs.relevant == 'true' - uses: erlef/setup-beam@v1.24.1 + uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: elixir-version: ${{ matrix.elixir }} otp-version: ${{ matrix.otp }} - if: steps.detect.outputs.relevant == 'true' - uses: actions/cache@v6.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | elixir-orchestration/deps @@ -97,7 +97,7 @@ jobs: run: working-directory: elixir-orchestration steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Detect relevant changes id: detect working-directory: ${{ github.workspace }} @@ -117,12 +117,12 @@ jobs: echo "relevant=true" >> "$GITHUB_OUTPUT" fi - if: steps.detect.outputs.relevant == 'true' - uses: erlef/setup-beam@v1.24.1 + uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: elixir-version: "1.17" otp-version: "27" - if: steps.detect.outputs.relevant == 'true' - uses: actions/cache@v6.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | elixir-orchestration/deps @@ -133,7 +133,7 @@ jobs: - if: steps.detect.outputs.relevant == 'true' run: mix coveralls.json - if: steps.detect.outputs.relevant == 'true' - uses: codecov/codecov-action@v7.1.0 + uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0 with: files: elixir-orchestration/cover/excoveralls.json flags: elixir @@ -148,7 +148,7 @@ jobs: run: working-directory: elixir-orchestration steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Detect relevant changes id: detect working-directory: ${{ github.workspace }} @@ -168,12 +168,12 @@ jobs: echo "relevant=true" >> "$GITHUB_OUTPUT" fi - if: steps.detect.outputs.relevant == 'true' - uses: erlef/setup-beam@v1.24.1 + uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: elixir-version: "1.17" otp-version: "27" - if: steps.detect.outputs.relevant == 'true' - uses: actions/cache@v6.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | elixir-orchestration/deps @@ -197,7 +197,7 @@ jobs: run: working-directory: elixir-orchestration steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Detect relevant changes id: detect working-directory: ${{ github.workspace }} @@ -217,7 +217,7 @@ jobs: echo "relevant=true" >> "$GITHUB_OUTPUT" fi - if: steps.detect.outputs.relevant == 'true' - uses: erlef/setup-beam@v1.24.1 + uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: elixir-version: "1.17" otp-version: "27" diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 4fd81fa..31974e7 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -28,8 +28,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + with: + toolchain: stable - name: Run core fuzz compile check run: | cd rust-core/fuzz @@ -43,8 +45,8 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - name: Run debugger fuzz compile check run: | cd debugger/fuzz diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml index 72856ea..39d5bb5 100644 --- a/.github/workflows/ghcr-publish.yml +++ b/.github/workflows/ghcr-publish.yml @@ -38,7 +38,7 @@ jobs: id-token: write # mint the OIDC token the attestation is signed with attestations: write # write the build-provenance attestation (the "claim") steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build image (Podman) run: | @@ -93,7 +93,7 @@ jobs: # --repo ${{ github.repository }} - name: Attest container provenance if: github.event_name != 'pull_request' - uses: actions/attest-build-provenance@v4.2.2 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ghcr.io/hyperpolymath/verisimdb-api subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index ff2eadd..e4c5bf1 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -19,7 +19,7 @@ jobs: timeout-minutes: 60 steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@v4.0.1 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index aaa0e9f..9bcd91b 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -22,9 +22,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -41,7 +41,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@v5.0.0 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: '_site' deploy: @@ -54,4 +54,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5.0.1 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 4a2bfc0..c575048 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -24,7 +24,7 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install reuse run: pip install reuse diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index f7e856e..4f919af 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -31,9 +31,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable with: + toolchain: stable components: rustfmt - run: cargo fmt --all -- --check @@ -42,8 +43,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable with: components: clippy - run: cargo clippy --workspace --all-targets --no-deps -- -D warnings @@ -53,8 +54,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - run: cargo test --workspace --no-fail-fast doc: @@ -64,8 +65,8 @@ jobs: env: RUSTDOCFLAGS: "-D warnings" steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - run: cargo doc --workspace --no-deps audit: @@ -73,8 +74,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 - - uses: rustsec/audit-check@v2.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} @@ -83,8 +84,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 - - uses: taiki-e/install-action@v2.87.13 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13 with: tool: cargo-deny - run: cargo deny check advisories bans licenses sources @@ -94,8 +95,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - run: cargo bench --no-run coverage: @@ -103,14 +104,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable with: components: llvm-tools-preview - - uses: taiki-e/install-action@v2.87.13 + - uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13 - name: Generate lcov report run: cargo llvm-cov --workspace --lcov --output-path lcov.info - - uses: codecov/codecov-action@v7.1.0 + - uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0 with: files: lcov.info flags: rust @@ -129,9 +130,9 @@ jobs: timeout-minutes: 60 if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable - - uses: taiki-e/install-action@v2.87.13 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13 with: tool: cargo-mutants - name: Run mutation tests on core invariant crates @@ -146,7 +147,7 @@ jobs: --no-shuffle \ --output mutants-out/ continue-on-error: true - - uses: actions/upload-artifact@v7.0.1 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: mutants-report @@ -162,6 +163,6 @@ jobs: - fuzz/Cargo.toml - rust-core/fuzz/Cargo.toml steps: - - uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - run: cargo check --manifest-path ${{ matrix.manifest }}