Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/Build.Linux.Job.yml

@@ -21,7 +21,7 @@ jobs:
       run:
         working-directory: src/core/lxc
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # actions-rust-lang/setup-rust-toolchain auto-reads rust-toolchain.toml
       # from the repo root only. Surface src/rust-toolchain.toml there so the
@@ -31,7 +31,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: cp src/rust-toolchain.toml rust-toolchain.toml
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           target: ${{ matrix.target }}
           components: rustfmt, clippy
@@ -41,7 +41,7 @@ jobs:
       - name: Point cargo at the MxcDependencies feed
         uses: ./.github/actions/setup-cargo-feed
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: |
             src -> target
@@ -104,7 +104,7 @@ jobs:
              -p unix_test_proxy
 
       - name: Upload binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: lxc-binaries-${{ matrix.target }}
           path: |

.github/workflows/Build.MacOS.Job.yml

@@ -12,7 +12,7 @@ jobs:
       run:
         working-directory: src
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # actions-rust-lang/setup-rust-toolchain auto-reads rust-toolchain.toml
       # from the repo root only. Surface src/rust-toolchain.toml there so the
@@ -22,7 +22,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: cp src/rust-toolchain.toml rust-toolchain.toml
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           target: aarch64-apple-darwin
           components: rustfmt, clippy
@@ -32,7 +32,7 @@ jobs:
       - name: Point cargo at the MxcDependencies feed
         uses: ./.github/actions/setup-cargo-feed
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: src -> target
           key: aarch64-apple-darwin-v2
@@ -56,7 +56,7 @@ jobs:
              -p mxc_darwin -p seatbelt_common -p wxc_common -p wxc_e2e_tests
 
       - name: Upload binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: mxc-binaries-aarch64-apple-darwin
           path: |

.github/workflows/Build.Windows.Job.yml

@@ -25,7 +25,7 @@ jobs:
       run:
         working-directory: src
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # actions-rust-lang/setup-rust-toolchain auto-reads rust-toolchain.toml
       # from the repo root only. Surface src/rust-toolchain.toml there so the
@@ -35,7 +35,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: cp src/rust-toolchain.toml rust-toolchain.toml
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           target: ${{ matrix.target }}
           components: rustfmt, clippy
@@ -45,7 +45,7 @@ jobs:
       - name: Point cargo at the MxcDependencies feed
         uses: ./.github/actions/setup-cargo-feed
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: src -> target
           key: ${{ matrix.target }}-v2
@@ -72,7 +72,7 @@ jobs:
              --features "${{ matrix.features }}"
 
       - name: Upload binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: wxc-binaries-${{ matrix.target }}
           path: |

.github/workflows/CodeQL.yml

@@ -41,10 +41,10 @@ jobs:
             build-mode: none
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -64,7 +64,7 @@ jobs:
 
       - name: Setup Rust toolchain
         if: matrix.language == 'rust'
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           target: ${{ matrix.target }}
           override: false
@@ -77,6 +77,6 @@ jobs:
       # ---- JS/TS: no build required; CodeQL extracts the source directly. ----
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5
         with:
           category: /language:${{ matrix.language }}

.github/workflows/Dependency.Feed.Check.Job.yml

@@ -15,12 +15,12 @@ jobs:
     name: Resolve deps through MxcDependencies feed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Surface toolchain file at repo root
         run: cp src/rust-toolchain.toml rust-toolchain.toml
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           override: false
           rustflags: ''

.github/workflows/Lint.Job.yml

@@ -34,7 +34,7 @@ jobs:
       run:
         working-directory: ${{ matrix.working-directory }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # actions-rust-lang/setup-rust-toolchain auto-reads rust-toolchain.toml
       # from the repo root only. Surface src/rust-toolchain.toml there so the
@@ -44,7 +44,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: cp src/rust-toolchain.toml rust-toolchain.toml
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           target: ${{ matrix.target }}
           components: rustfmt, clippy
@@ -54,7 +54,7 @@ jobs:
       - name: Point cargo at the MxcDependencies feed
         uses: ./.github/actions/setup-cargo-feed
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: ${{ matrix.working-directory }} -> target
           key: lint-${{ matrix.target }}-v2

.github/workflows/Package.NpmSdk.Job.yml

@@ -11,9 +11,9 @@ jobs:
       run:
         working-directory: sdk/node
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: npm
@@ -23,27 +23,27 @@ jobs:
       # packager expects. Windows-x64 + Linux-x64 both land under bin/x64
       # but the binaries have disjoint filenames so they don't collide.
       - name: Download wxc-binaries x64
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: wxc-binaries-x86_64-pc-windows-msvc
           path: sdk/node/bin/x64
       - name: Download wxc-binaries arm64
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: wxc-binaries-aarch64-pc-windows-msvc
           path: sdk/node/bin/arm64
       - name: Download lxc-binaries x64
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: lxc-binaries-x86_64-unknown-linux-gnu
           path: sdk/node/bin/x64
       - name: Download lxc-binaries arm64
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: lxc-binaries-aarch64-unknown-linux-gnu
           path: sdk/node/bin/arm64
       - name: Download mxc-binaries arm64 (mac)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: mxc-binaries-aarch64-apple-darwin
           path: sdk/node/bin/arm64
@@ -63,7 +63,7 @@ jobs:
       - run: npm pack
 
       - name: Upload SDK package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: npm-packages
           path: sdk/node/*.tgz

.github/workflows/SDK.Integration.Test.Job.yml

@@ -33,16 +33,16 @@ jobs:
       # `.azure-pipelines/templates/SDK.Integration.Test.Job.yml`.
       MXC_SKIP_LXC_NETWORK_TESTS: '1'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: npm
           cache-dependency-path: sdk/node/tests/integration/package-lock.json
 
       - name: Download SDK package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: npm-packages
           path: sdk-pkg
@@ -60,7 +60,7 @@ jobs:
 
       - name: Install bubblewrap + LXC stack (Linux only, cached)
         if: matrix.os_label == 'linux'
-        uses: awalsh128/cache-apt-pkgs-action@v1
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           # Installs the LXC + Bubblewrap substrate the SDK integration
           # tests need. Capability probe 27576588204 confirmed these

.github/workflows/SDK.Unit.Test.Job.yml

@@ -19,9 +19,9 @@ jobs:
       run:
         working-directory: sdk/node
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: npm

.github/workflows/Versioning.Checks.Job.yml

@@ -8,9 +8,9 @@ jobs:
     name: Versioning Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
 

.github/workflows/hyperlight-e2e.yml

@@ -17,7 +17,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Setup Rust toolchain
         run: |
@@ -28,7 +28,7 @@ jobs:
         uses: ./.github/actions/setup-cargo-feed
 
       - name: Cache Rust build artifacts
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: src
 
@@ -104,7 +104,7 @@ jobs:
 
       - name: Upload logs on failure
         if: failure() || cancelled()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: hyperlight-e2e-logs-${{ github.event.pull_request.number || github.run_number }}
           retention-days: 7

.github/workflows/microvm-e2e.yml

@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Setup Rust toolchain
         run: |
@@ -29,7 +29,7 @@ jobs:
         uses: ./.github/actions/setup-cargo-feed
 
       - name: Cache Rust build artifacts
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: src
 
@@ -86,7 +86,7 @@ jobs:
 
       - name: Upload logs on failure
         if: failure() || cancelled()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: microvm-e2e-logs-${{ github.event.pull_request.number || github.run_number }}
           retention-days: 7
@@ -101,7 +101,7 @@ jobs:
 
       - name: Upload performance results
         if: steps.whp-check.outputs.whp_available == 'true' && !cancelled()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: microvm-perf-results-${{ github.event.pull_request.number || github.run_number }}
           retention-days: 30