ci: pin every workflow action to a full commit sha; nightly zizmor lint (LAB)

.github/workflows/assets-rehearsal-nightly.yml

@@ -122,7 +122,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building pv for $TAG -> ${{ matrix.target }} on ${{ matrix.host }}"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
@@ -277,7 +277,7 @@ jobs:
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
@@ -440,7 +440,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building apr --features cuda for $TAG → ${{ matrix.target }}"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
@@ -592,7 +592,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building apr (default features, no cuda) for $TAG -> ${{ matrix.target }}"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
@@ -745,7 +745,7 @@ jobs:
           [ -n "$TAG" ] || { echo "::error::No tag resolved"; exit 1; }
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)

.github/workflows/beat-speed-nightly.yml

@@ -78,7 +78,7 @@ jobs:
       # fix for it (#2326). `github` IS a valid context at job level.
       BEAT_LOG: ${{ github.workspace }}/beat-speed-measurements.log
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # PERF-031 measurement-environment receipt.
       #

.github/workflows/binary-release.yml

@@ -98,7 +98,7 @@ jobs:
     outputs:
       present: ${{ steps.check.outputs.present }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - id: check
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -158,7 +158,7 @@ jobs:
           echo "Building pv for $TAG -> ${{ matrix.target }} on ${{ matrix.host }}"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -325,7 +325,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -486,7 +486,7 @@ jobs:
           echo "Building apr --features cuda for $TAG → ${{ matrix.target }}"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -657,7 +657,7 @@ jobs:
           echo "Building apr (default features, no cuda) for $TAG -> ${{ matrix.target }}"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -827,7 +827,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -920,7 +920,7 @@ jobs:
       # This job had no checkout: it curled the API and parsed with python3. The
       # preflight needs the tree, and so does the checker — and the tree is one
       # second on the clean-room pool.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Preflight - this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh
@@ -960,7 +960,7 @@ jobs:
             labels: '["self-hosted", "Linux", "ARM64", "cuda", "gx10", "ephemeral", "docker"]'
     runs-on: ${{ fromJSON(matrix.labels) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # The smoke step below needs curl, python3, sha256sum, tar and a visible
       # device. Each of those is a separate way for this job to fail late and
@@ -1044,7 +1044,7 @@ jobs:
             preflight: '--need docker objdump'
     runs-on: ${{ fromJSON(matrix.labels) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # No `--cuda` on any row, including the GPU ones: this job proves a CPU
       # asset, and a device assertion here would make a green depend on hardware
@@ -1105,7 +1105,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     if: always()
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Preflight — this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh

.github/workflows/book-contracts.yml

@@ -61,8 +61,8 @@ jobs:
     name: Chapter Examples Compile
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec  # stable
       # NO rust-cache: cache-bin false was never the fix.
       #
       # It skips cleanBin and NOTHING else. rust-cache's save step also runs
@@ -105,8 +105,8 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     needs: chapter-examples-compile
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec  # stable
       # NO rust-cache: cache-bin false was never the fix.
       #
       # It skips cleanBin and NOTHING else. rust-cache's save step also runs
@@ -156,8 +156,8 @@ jobs:
     name: Book Integration Tests
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec  # stable
       # NO rust-cache: cache-bin false was never the fix.
       #
       # It skips cleanBin and NOTHING else. rust-cache's save step also runs
@@ -188,7 +188,7 @@ jobs:
     name: Contract Enforcement
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Every chapter has a contract
         run: |
           FAIL=0
@@ -248,7 +248,7 @@ jobs:
     name: Namespace Discipline
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: No legacy imports in chapter examples
         run: |
           FAIL=0
@@ -289,7 +289,7 @@ jobs:
     name: SUMMARY.md Integrity
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: No dead links in SUMMARY.md
         run: |
           FAIL=0

.github/workflows/book.yml

@@ -74,7 +74,7 @@ jobs:
     name: Build Book
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # Self-hosted (#3073): tools go into this run's private $RUNNER_TEMP, never a $HOME path that every
       # runner on the box execs from (the aprender#2353 race; check_cargo_install_private_root.sh enforces
@@ -199,7 +199,7 @@ jobs:
           fi
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5
         with:
           path: ./book/book
 
@@ -221,4 +221,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346  # v5

.github/workflows/ci-unwedge.yml

@@ -62,7 +62,7 @@ jobs:
     runs-on: ${{ github.event.schedule == '*/10 0-5,20-23 * * *' && fromJSON('["self-hosted", "X64", "Linux", "clean-room"]') || fromJSON('["self-hosted", "Linux", "clean-room", "ARM64"]') }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # The instrument proves itself before it is allowed to cancel anything.
       # Fifteen rows over committed fixtures, no network: three wedged shapes,

.github/workflows/ci.yml

@@ -113,7 +113,7 @@ jobs:
     steps:
       # Full history: the key reads the queue head's parent, the base's parent and
       # whether the base is an ancestor of the PR head.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       - name: The reuse key's case table (hermetic)
@@ -145,7 +145,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: The reuse key's case table (hermetic)
         run: bash scripts/ci_mg_reuse.sh --self-test
       - name: The fat wait is cancel-aware and the teardown still runs on cancel
@@ -202,7 +202,7 @@ jobs:
           [ "$(jq --version)" = "jq-1.8.2" ] || { echo "::error::jq on PATH reports $(jq --version)"; exit 1; }
       # Full history: a section whose own checkout asked for depth 1 (the default)
       # is cut back to exactly that by the driver; one asking for 0 needs it all.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       # Fail fast: the reds car#4429 took four fat runs to see, in ~2 min, before
@@ -253,7 +253,7 @@ jobs:
           --results "$RUNNER_TEMP/fat/results.json"
           --background-until 'determinism[X64]'
       # Published mid-run: the determinism job's compare section is waiting for it.
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: determinism-X64
           path: ${{ runner.temp }}/fat/artifacts/determinism-X64/
@@ -272,14 +272,14 @@ jobs:
       - name: Remove this job's section containers (runs on cancel too)
         if: always()
         run: if [ -f scripts/ci/fat_teardown.sh ]; then bash scripts/ci/fat_teardown.sh "$GITHUB_RUN_ID" "$RUNNER_TEMP"; fi
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: pr-review-shadow-sample
           path: ${{ runner.temp }}/fat/artifacts/pr-review-shadow-sample/
           retention-days: 90
           if-no-files-found: ignore
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: bench-${{ github.event.repository.name }}
@@ -319,7 +319,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Install cargo-deny (if absent)
         env:
           CARGO_INSTALL_ROOT: ${{ runner.temp }}/cargo-deny
@@ -380,7 +380,7 @@ jobs:
       FAT_EXPECT_ARTIFACTS: determinism-X64,determinism-ARM64
       FAT_ARTIFACT_WAIT_S: "0"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       - name: Sections (the ARM64 raster returns first; the compare keeps running)
@@ -389,7 +389,7 @@ jobs:
           --sections 'determinism[ARM64],determinism-compare'
           --results "$RUNNER_TEMP/fat/results.json"
           --background-until 'determinism[ARM64]'
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: determinism-ARM64
           path: ${{ runner.temp }}/fat/artifacts/determinism-ARM64/
@@ -407,13 +407,13 @@ jobs:
       - name: Remove this job's section containers (runs on cancel too)
         if: always()
         run: if [ -f scripts/ci/fat_teardown.sh ]; then bash scripts/ci/fat_teardown.sh "$GITHUB_RUN_ID" "$RUNNER_TEMP"; fi
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: determinism-receipt
           path: ${{ runner.temp }}/fat/artifacts/determinism-receipt/
           if-no-files-found: ignore
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: raster-receipt
@@ -453,7 +453,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       FAT_VARS_JSON: ${{ toJSON(vars) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       # #4596: see the x86-main step of the same name.
@@ -474,7 +474,7 @@ jobs:
       - name: Remove this job's section containers (runs on cancel too)
         if: always()
         run: if [ -f scripts/ci/fat_teardown.sh ]; then bash scripts/ci/fat_teardown.sh "$GITHUB_RUN_ID" "$RUNNER_TEMP"; fi
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: sigma-shard-${{ matrix.shard }}
@@ -500,8 +500,8 @@ jobs:
           set -euo pipefail
           echo "workspace-test-shard matrix result: $SHARD_RESULT"
           [ "$SHARD_RESULT" = success ] || { echo "::error::workspace-test: shard matrix result is '$SHARD_RESULT' (a cancelled or skipped shard is not a pass)"; exit 1; }
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           pattern: sigma-shard-*
           path: ${{ runner.temp }}/sigma

.github/workflows/conleche-nightly.yml

@@ -46,7 +46,7 @@ jobs:
       ELAN_SHA256: 42b94d4244e8353142c456ec0e4ca6528fd898a6c604d4059f494e706e431f63
       LEAN_NUM_THREADS: '8'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 1
       - name: Verdict case table (the classifier this job trusts)

.github/workflows/coverage-nightly.yml

@@ -106,7 +106,7 @@ jobs:
       # pristine tree, and the default git-clean choked on root-owned leftovers
       # (e.g. contracts/.pv/cache from prior `pv` jobs → EACCES on rmdir),
       # failing checkout before any coverage ran.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           clean: false
 
@@ -241,7 +241,7 @@ jobs:
       - name: Upload coverage JSON
         if: always() && hashFiles('target/coverage/coverage.json') != ''
         continue-on-error: true
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: coverage-json
           path: |
@@ -266,7 +266,7 @@ jobs:
       - name: Publish the coverage receipt
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: coverage-receipt
           path: ${{ runner.temp }}/cov-receipt/coverage-receipt-*.json