perf + security: hot-path batching, action/source pins, local API token

.depot/workflows/android-instrumented.yml

@@ -34,16 +34,16 @@ jobs:
     runs-on: depot-ubuntu-24.04-8
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           distribution: 'temurin'
           java-version: '17'
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
 
       - name: Install SDK platform + NDK
         run: |
@@ -71,14 +71,14 @@ jobs:
 
       - name: libcore cache
         id: libcore-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: app/libs/libcore.aar
           key: depot-libcore-${{ env.GO_VERSION }}-${{ env.NDK_VERSION }}-${{ hashFiles('libcore_status') }}
 
       - name: Install Go
         if: steps.libcore-cache.outputs.cache-hit != 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -98,7 +98,7 @@ jobs:
           echo "KVM present"
 
       - name: Run migration test on emulator
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2
         with:
           api-level: 33
           arch: x86_64

.depot/workflows/build-apk.yml

@@ -21,16 +21,16 @@ jobs:
     runs-on: depot-ubuntu-24.04-8
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           distribution: 'temurin'
           java-version: '17'
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
 
       - name: Install SDK platform + NDK
         run: sdkmanager --install "platforms;android-35" "build-tools;35.0.0" "ndk;${NDK_VERSION}"
@@ -51,7 +51,7 @@ jobs:
 
       - name: libcore cache
         id: libcore-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: app/libs/libcore.aar
           key: depot-libcore-${{ env.GO_VERSION }}-${{ env.NDK_VERSION }}-${{ hashFiles('libcore_status') }}
@@ -72,14 +72,14 @@ jobs:
 
       - name: sidecars cache
         id: sidecars-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: app/executableSo
           key: depot-sidecars-${{ env.GO_VERSION }}-${{ env.NDK_VERSION }}-${{ env.MIERU_VERSION }}-${{ env.MDVPN_COMMIT }}-${{ env.NAIVE_VERSION }}-${{ env.OLCRTC_COMMIT }}-${{ hashFiles('sidecars_status') }}
 
       - name: Install Go
         if: steps.libcore-cache.outputs.cache-hit != 'true' || steps.sidecars-cache.outputs.cache-hit != 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -108,7 +108,7 @@ jobs:
           done
 
       - name: Gradle cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.gradle
           key: depot-gradle-oss-${{ hashFiles('**/*.gradle.kts') }}
@@ -145,7 +145,7 @@ jobs:
           echo "Built APK: $APK_FILE"
 
       - name: Upload APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: NekoBox-debug-arm64-v8a-apk
           path: ${{ env.APK_FILE }}

.depot/workflows/guard.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: depot-ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Guard - AGENTS.md must stay untracked
         run: bash ./scripts/check-agents-untracked.sh
       - name: Guard - no backed-up SharedPreferences

.depot/workflows/lint.yml

@@ -30,14 +30,14 @@ jobs:
     runs-on: depot-ubuntu-24.04-4
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           distribution: 'temurin'
           java-version: '17'
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
       - name: Install SDK platform + NDK
         run: sdkmanager --install "platforms;android-35" "build-tools;35.0.0" "ndk;${NDK_VERSION}"
       - name: local.properties
@@ -55,13 +55,13 @@ jobs:
             | awk '{print $1}' > libcore_status
       - name: libcore cache
         id: libcore-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: app/libs/libcore.aar
           key: depot-libcore-${{ env.GO_VERSION }}-${{ env.NDK_VERSION }}-${{ hashFiles('libcore_status') }}
       - name: Install Go
         if: steps.libcore-cache.outputs.cache-hit != 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Build libcore (Go + gomobile)
@@ -75,7 +75,7 @@ jobs:
       # If lint just created the baseline (first run), surface it so it can be committed.
       - name: Upload lint baseline (if generated)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: lint-baseline
           path: app/lint-baseline.xml

.depot/workflows/unit-tests.yml

@@ -32,14 +32,14 @@ jobs:
     runs-on: depot-ubuntu-24.04-4
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           distribution: 'temurin'
           java-version: '17'
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
       - name: Install SDK platform + NDK
         run: sdkmanager --install "platforms;android-35" "build-tools;35.0.0" "ndk;${NDK_VERSION}"
       - name: local.properties
@@ -57,13 +57,13 @@ jobs:
             | awk '{print $1}' > libcore_status
       - name: libcore cache
         id: libcore-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: app/libs/libcore.aar
           key: depot-libcore-${{ env.GO_VERSION }}-${{ env.NDK_VERSION }}-${{ hashFiles('libcore_status') }}
       - name: Install Go
         if: steps.libcore-cache.outputs.cache-hit != 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Build libcore (Go + gomobile)

.github/workflows/build.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: namespace-profile-nekoyay
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Golang Status
         run: find buildScript libcore/*.sh | xargs cat | sha1sum > golang_status
       - name: Libcore Status
@@ -33,7 +33,7 @@ jobs:
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}
       - name: Install Golang
         if: steps.cache.outputs.cache-hit != 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: '1.26.4'
       - name: Native Build
@@ -77,7 +77,7 @@ jobs:
           rm -rf "$tmp"
           exit "$fail"
       - name: Upload LibCore
-        uses: namespace-actions/upload-artifact@v1
+        uses: namespace-actions/upload-artifact@f6ccaacc655aec41b93af180d1d7eef21af862d2 # v1
         with:
           name: libcore-aar-build
           path: app/libs/libcore.aar
@@ -88,7 +88,7 @@ jobs:
     runs-on: namespace-profile-nekoyay
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Sidecars Status
         run: cat buildScript/lib/mieru.sh buildScript/lib/masterdnsvpn.sh buildScript/lib/naive.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
@@ -100,7 +100,7 @@ jobs:
           key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.MDVPN_COMMIT }}-${{ env.NAIVE_VERSION }}-sidecars
       - name: Install Golang
         if: steps.cache.outputs.cache-hit != 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: '1.26.4'
       - name: Mieru Build
@@ -113,7 +113,7 @@ jobs:
         if: steps.cache.outputs.cache-hit != 'true'
         run: ./run lib naive
       - name: Upload Sidecars
-        uses: namespace-actions/upload-artifact@v1
+        uses: namespace-actions/upload-artifact@f6ccaacc655aec41b93af180d1d7eef21af862d2 # v1
         with:
           name: sidecars-so-build
           path: app/executableSo
@@ -127,14 +127,14 @@ jobs:
       - sidecars
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Download LibCore
-        uses: namespace-actions/download-artifact@v1
+        uses: namespace-actions/download-artifact@5c070f7d7ebdc47682b04aa736c76e46ff5f6e1e # v1
         with:
           name: libcore-aar-build
           path: app/libs
       - name: Download Sidecars
-        uses: namespace-actions/download-artifact@v1
+        uses: namespace-actions/download-artifact@5c070f7d7ebdc47682b04aa736c76e46ff5f6e1e # v1
         with:
           name: sidecars-so-build
           path: app/executableSo
@@ -174,7 +174,7 @@ jobs:
           APK=$(dirname "$APK")
           echo "APK=$APK" >> $GITHUB_ENV
       - name: Upload Artifacts
-        uses: namespace-actions/upload-artifact@v1
+        uses: namespace-actions/upload-artifact@f6ccaacc655aec41b93af180d1d7eef21af862d2 # v1
         with:
           name: NekoBoxs
           path: ${{ env.APK }}