Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -22,6 +22,8 @@ updates:
       github-actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
 
   # Broker images for the live network suite. Test infrastructure, so the exclusion above
   # doesn't apply -- nothing here reaches consumers.
@@ -43,4 +45,4 @@ updates:
     groups:
       broker-images:
         patterns:
-          - "*"
+          - "*"

.github/workflows/fuzz.yaml

@@ -55,10 +55,10 @@ jobs:
         target: ["packet_decode", "packet_roundtrip", "topics"]
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         cache: false
         rustflags: ''
@@ -79,7 +79,7 @@ jobs:
         rustup target add x86_64-unknown-linux-gnu --toolchain nightly
 
     - name: Cache cargo build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         # `fuzz/` is its own workspace; the instrumented build is cache-
         # incompatible with the gate's plain check, so key it separately.
@@ -90,15 +90,15 @@ jobs:
     # run, save it back. This is what makes fuzzing compound over time rather
     # than starting cold each run.
     - name: Restore/persist fuzz corpus
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: fuzz/corpus/${{ matrix.target }}
         key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
         restore-keys: |
           fuzz-corpus-${{ matrix.target }}-
 
     - name: Install cargo-fuzz
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
       with:
         tool: cargo-fuzz
 
@@ -113,7 +113,7 @@ jobs:
     # attached to the run for triage and can be committed as a regression test.
     - name: Upload crash reproducer
       if: failure()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: fuzz-crash-${{ matrix.target }}
         path: fuzz/artifacts/${{ matrix.target }}

.github/workflows/network.yaml

@@ -66,12 +66,12 @@ jobs:
             kubernetes: true
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     # kubectl ships with the runner image; helm is pinned and k3d isn't present at all.
     - name: Install Helm
       if: matrix.kubernetes
-      uses: azure/setup-helm@v5
+      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
         version: 'v3.16.3'
 
@@ -84,7 +84,7 @@ jobs:
         k3d version
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         # Swatinem/rust-cache (below) handles caching, including target/.
         cache: false
@@ -93,7 +93,7 @@ jobs:
         rustflags: ''
 
     - name: Cache cargo build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         shared-key: network
 

.github/workflows/nightly.yaml

@@ -57,10 +57,10 @@ jobs:
         rust: ["1.88", "stable", "beta", "nightly"]
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         cache: false
         # No `-D warnings`: this workflow runs tests across moving toolchains,
@@ -71,7 +71,7 @@ jobs:
       run: rustup toolchain install ${{ matrix.rust }} --profile minimal
 
     - name: Cache cargo build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         shared-key: nightly-test-${{ matrix.rust }}
 
@@ -102,10 +102,10 @@ jobs:
         deps: ["latest", "minimal"]
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         cache: false
         # No `-D warnings` (see the `test` job above).
@@ -118,7 +118,7 @@ jobs:
       run: rustup toolchain install nightly --profile minimal
 
     - name: Install cargo tooling
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
       with:
         tool: cargo-deny
 

.github/workflows/pr.yaml

@@ -53,10 +53,10 @@ jobs:
     timeout-minutes: 10
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         # Swatinem/rust-cache (below) handles caching, including target/,
         # which this action's built-in cache does not.
@@ -68,14 +68,14 @@ jobs:
         rustflags: ''
 
     - name: Cache cargo build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         shared-key: check
 
     # Install cargo subcommands AFTER the cache restore: Swatinem/rust-cache
     # caches ~/.cargo/bin, so a warm cache makes this a no-op.
     - name: Install cargo tooling
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
       with:
         tool: cargo-machete,cargo-deny
 
@@ -97,18 +97,18 @@ jobs:
     timeout-minutes: 10
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         cache: false
         # No `-D warnings`: the fuzz crate isn't held to the library's
         # warning-denial policy (see the `check` job).
         rustflags: ''
 
     - name: Cache cargo build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         # `fuzz/` is a separate workspace with its own target/, so point the
         # cache at it explicitly and key it apart from the library builds.
@@ -151,10 +151,10 @@ jobs:
         deps: ["latest", "minimal"]
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         cache: false
         # No `-D warnings` on the toolchain matrix (see the `check` job).
@@ -171,7 +171,7 @@ jobs:
       run: rustup toolchain install ${{ matrix.rust }} --profile minimal
 
     - name: Cache cargo build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         # `deps` is part of the key: latest and minimal builds produce
         # incompatible target/ artifacts and must not share a cache.
@@ -208,17 +208,17 @@ jobs:
     timeout-minutes: 15
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         cache: false
         # No `-D warnings` here either (see the `check` job).
         rustflags: ''
 
     - name: Cache cargo build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         # The `__network` feature builds a target the other jobs don't, so keep
         # its target/ separate from theirs.
@@ -247,24 +247,24 @@ jobs:
     timeout-minutes: 20
 
     steps:
-    - uses: 'actions/checkout@v7'
+    - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
     - name: Setup Rust (pinned via rust-toolchain.toml)
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
       with:
         cache: false
         # No `-D warnings` on the toolchain matrix (see the `check` job).
         rustflags: ''
 
     - name: Cache cargo build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         # Distinct from the `test` keys: instrumented builds must not share
         # target/ with them.
         shared-key: coverage
 
     - name: Install cargo tooling
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
       with:
         tool: cargo-llvm-cov
 
@@ -273,7 +273,7 @@ jobs:
       run: make network-coverage BROKER=mosquitto
 
     - name: Upload coverage report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coverage-report
         path: target/llvm-cov/html