chore: pin GitHub Actions to full-length commit SHAs

.github/actions/setup/action.yml

@@ -94,23 +94,27 @@ runs:
 
     - name: Start Sccache
       if: inputs.enable-sccache == 'true' && !(runner.os == 'Windows' && runner.arch == 'ARM64')
-      uses: mozilla-actions/sccache-action@v0.0.10
+      uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
       with:
         version: ${{ env.SCCACHE_VERSION }}
 
     - name: Install Rust
       if: inputs.rust-toolchain != ''
-      uses: actions-rust-lang/setup-rust-toolchain@v1.16.1
+      uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
       with:
         toolchain: ${{ steps.expand.outputs.toolchain }}
         components: ${{ inputs.rust-components }}
 
     - name: Install Cargo Tools
       if: inputs.cargo-tools != ''
+      # taiki-e/install-action publishes immutable GitHub releases (verified via the GitHub API:
+      # "immutable": true on GET /repos/taiki-e/install-action/releases/tags/v2.81.8). The tag
+      # cannot be retargeted, so this reference is intentionally left unpinned to a commit SHA.
+      # See https://github.com/taiki-e/install-action/releases/tag/v2.81.8
       uses: taiki-e/install-action@v2.81.8
       with:
         tool: ${{ steps.expand.outputs.cargo_tools }}
 
     - name: Install Wild Linker
       if: inputs.enable-wild-linker == 'true'
-      uses: wild-linker/action@0.9.0
+      uses: wild-linker/action@0bbbfa5df4380cab8e63cb8505a1ce65e1d10203 # 0.9.0

.github/dependabot.yml

@@ -21,3 +21,8 @@ updates:
   directory: "/"
   schedule:
     interval: "monthly"
+  # 7-day cooldown before Dependabot proposes a newly published Action version. This gives
+  # the community/security researchers a window to detect and report a compromised or
+  # "poisoned" release before it's automatically pulled into this repo.
+  cooldown:
+    default-days: 7

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7.0.0
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -66,6 +66,10 @@ jobs:
     #   uses: actions/setup-example@v1
 
     # Initializes the CodeQL tools for scanning.
+    # github/codeql-action publishes immutable GitHub releases (verified via the GitHub API:
+    # "immutable": true on GET /repos/github/codeql-action/releases/tags/v4.36.2). The tag cannot
+    # be retargeted, so init/analyze below are intentionally left pinned to the tag, not a SHA.
+    # See https://github.com/github/codeql-action/releases/tag/v4.36.2
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4.36.2
       with:
@@ -95,6 +99,7 @@ jobs:
         echo '  make release'
         exit 1
 
+    # See the immutable-release note above (github/codeql-action) — same tag, same rationale.
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v4.36.2
       with:

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
       skip: ${{ steps.compute.outputs.skip }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup
@@ -101,7 +101,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -141,7 +141,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -184,7 +184,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 1
       - name: Setup
@@ -216,7 +216,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup
@@ -278,7 +278,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -315,7 +315,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -335,7 +335,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -354,7 +354,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup
@@ -395,7 +395,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -410,6 +410,11 @@ jobs:
       - name: Generate Coverage (no-default-features)
         run: cargo +${{ env.RUST_NIGHTLY }} llvm-cov --no-default-features --workspace --lcov --output-path lcov-no-def.info
       - name: Upload Coverage to Codecov
+        # codecov/codecov-action publishes immutable GitHub releases (verified via the GitHub API:
+        # "immutable": true on GET /repos/codecov/codecov-action/releases/tags/v7.0.0). An immutable
+        # release's tag can never be retargeted to a different commit, so pinning to a SHA adds no
+        # extra protection here; this reference is intentionally left as a tag.
+        # See https://github.com/codecov/codecov-action/releases/tag/v7.0.0
         uses: codecov/codecov-action@v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -421,7 +426,7 @@ jobs:
     if: github.event_name == 'pull_request'
     steps:
       - name: Check PR Title
-        uses: amannn/action-semantic-pull-request@v6.1.1
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -445,7 +450,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 1
       - name: Setup
@@ -468,7 +473,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -495,7 +500,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         # The synthetic-workspace fixture builder shells out to `cargo metadata`,
         # so Rust must be available even though no Rust code is compiled.

.github/workflows/nightly.yml

@@ -15,7 +15,7 @@ jobs:
     outputs:
       should_skip: ${{ steps.check.outputs.should_skip }}
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -38,7 +38,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -67,7 +67,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -118,7 +118,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -141,7 +141,7 @@ jobs:
     steps:
       # prep
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup
         uses: ./.github/actions/setup
         with:

.github/workflows/publish-gh-release.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
     - name: Checkout
-      uses: actions/checkout@v7.0.0
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Setup
       uses: ./.github/actions/setup