ci: pin GitHub Actions to commit SHAs; checksum bazelisk

.github/workflows/binding-release-candidate.yml

@@ -22,7 +22,7 @@ jobs:
     outputs:
       evidence_sha: ${{ steps.source.outputs.evidence_sha }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 1
@@ -57,7 +57,7 @@ jobs:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
       EVIDENCE_SHA: ${{ needs.validate_source.outputs.evidence_sha }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.validate_source.outputs.evidence_sha }}
 
@@ -67,30 +67,29 @@ jobs:
           [[ "$EVIDENCE_SHA" =~ ^[0-9a-f]{40}$ ]]
           test "$(git rev-parse HEAD)" = "$EVIDENCE_SHA"
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
 
-      - uses: astral-sh/setup-uv@v9.0.0
-
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       - name: Mount shared Linux Cargo build disk
         if: matrix.sticky_target == 'true'
-        uses: useblacksmith/stickydisk@v1
+        uses: useblacksmith/stickydisk@35ba2e331a80056a42af053ee54968511de2b7c7 # v1.5.0
         with:
           # Python Ubuntu and Linux Node targets share compatible release products.
           key: ${{ github.repository }}-binding-rc-linux-rust-1.96.0-${{ hashFiles('Cargo.lock') }}-release-target-v1
           path: target
 
       - name: Cache Cargo registry
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
           key: ${{ runner.os }}-cargo-registry-v1-${{ hashFiles('Cargo.lock') }}
 
       - name: Build native abi3 wheel
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           command: build
           args: --release --manifest-path crates/graphforge-bindings-py/Cargo.toml --out dist
@@ -194,15 +193,15 @@ jobs:
           cp "$PYTHON_RC_EVIDENCE_DIR/${{ matrix.target }}.json" binding-rc-reports/
 
       - name: Save Python report for aggregate job
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binding-rc-report-${{ github.run_id }}-${{ matrix.target }}
           path: binding-rc-reports/${{ matrix.target }}.json
           if-no-files-found: error
           retention-days: 1
 
       - name: Save tested wheel for release-candidate assembly
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binding-rc-wheel-${{ github.run_id }}-${{ matrix.target }}
           path: dist/*.whl
@@ -260,7 +259,7 @@ jobs:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
       EVIDENCE_SHA: ${{ needs.validate_source.outputs.evidence_sha }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.validate_source.outputs.evidence_sha }}
 
@@ -270,28 +269,27 @@ jobs:
           [[ "$EVIDENCE_SHA" =~ ^[0-9a-f]{40}$ ]]
           test "$(git rev-parse HEAD)" = "$EVIDENCE_SHA"
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
           architecture: ${{ matrix.node_arch }}
 
-      - uses: pnpm/action-setup@v4
-
-      - uses: dtolnay/rust-toolchain@master
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master as of 2026-08-05
         with:
           toolchain: "1.96.0"
           targets: ${{ matrix.target }}
 
       - name: Mount shared Linux Cargo build disk
         if: matrix.sticky_target == 'true'
-        uses: useblacksmith/stickydisk@v1
+        uses: useblacksmith/stickydisk@35ba2e331a80056a42af053ee54968511de2b7c7 # v1.5.0
         with:
           # Python Ubuntu and Linux Node targets share compatible release products.
           key: ${{ github.repository }}-binding-rc-linux-rust-1.96.0-${{ hashFiles('Cargo.lock') }}-release-target-v1
           path: target
 
       - name: Cache Cargo registry
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -395,15 +393,15 @@ jobs:
           cp "crates/graphforge-bindings-node/${{ matrix.report_target }}.json" binding-rc-reports/
 
       - name: Save Node report for aggregate job
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binding-rc-report-${{ github.run_id }}-${{ matrix.report_target }}
           path: binding-rc-reports/${{ matrix.report_target }}.json
           if-no-files-found: error
           retention-days: 1
 
       - name: Save tested addon for release-candidate assembly
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binding-rc-addon-${{ github.run_id }}-${{ matrix.target }}
           path: crates/graphforge-bindings-node/*.node
@@ -419,12 +417,12 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.validate_source.outputs.evidence_sha }}
 
       - name: Download exact-run target reports
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: binding-rc-report-${{ github.run_id }}-*
           path: binding-rc-reports
@@ -439,7 +437,7 @@ jobs:
           --output binding-rc-aggregate/report.json
 
       - name: Retain aggregate publication evidence
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: M1-Binding-Release-Candidate-${{ needs.validate_source.outputs.evidence_sha }}
           path: binding-rc-aggregate/report.json
@@ -456,7 +454,7 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.validate_source.outputs.evidence_sha }}
 
@@ -485,45 +483,43 @@ jobs:
           esac
           printf 'RELEASE_VERSION=%s\n' "$release_version" >> "$GITHUB_ENV"
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
 
-      - uses: astral-sh/setup-uv@v9.0.0
-
-      - uses: actions/setup-node@v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
-      - uses: pnpm/action-setup@v4
-
-      - uses: dtolnay/rust-toolchain@master
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master as of 2026-08-05
         with:
           toolchain: "1.96.0"
 
       - name: Mount release assembly Cargo build disk
-        uses: useblacksmith/stickydisk@v1
+        uses: useblacksmith/stickydisk@35ba2e331a80056a42af053ee54968511de2b7c7 # v1.5.0
         with:
           key: ${{ github.repository }}-release_candidate-rust-1.96.0-${{ hashFiles('Cargo.lock') }}-release-target-v1
           path: target
 
       - name: Cache Cargo registry
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
           key: ${{ runner.os }}-cargo-registry-v1-${{ hashFiles('Cargo.lock') }}
 
       - name: Download exact-run tested wheels
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: binding-rc-wheel-${{ github.run_id }}-*
           path: candidate/release-artifacts/python
           merge-multiple: true
 
       - name: Download exact-run tested Node addons
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: binding-rc-addon-${{ github.run_id }}-*
           path: candidate/release-artifacts/node-addons
@@ -661,39 +657,39 @@ jobs:
             --version "$RELEASE_VERSION"
 
       - name: Retain the candidate manifest for publication
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: M1-Release-Candidate-manifest-${{ needs.validate_source.outputs.evidence_sha }}
           path: candidate/v${{ env.RELEASE_VERSION }}-artifacts.json
           if-no-files-found: error
           retention-days: 30
 
       - name: Retain the Python candidate partition
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: M1-Release-Candidate-python-${{ needs.validate_source.outputs.evidence_sha }}
           path: candidate/release-artifacts/python/
           if-no-files-found: error
           retention-days: 30
 
       - name: Retain the npm candidate partition
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: M1-Release-Candidate-npm-${{ needs.validate_source.outputs.evidence_sha }}
           path: candidate/release-artifacts/npm/
           if-no-files-found: error
           retention-days: 30
 
       - name: Retain the crates candidate partition
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: M1-Release-Candidate-crates-${{ needs.validate_source.outputs.evidence_sha }}
           path: candidate/release-artifacts/crates/
           if-no-files-found: error
           retention-days: 30
 
       - name: Retain the evidence candidate partition
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: M1-Release-Candidate-evidence-${{ needs.validate_source.outputs.evidence_sha }}
           # upload-artifact does not expand bash brace globs; list both dirs.

.github/workflows/checkpoint-recovery-gate.yml

@@ -18,8 +18,8 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_PROFILE_TEST_DEBUG: 0
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@master
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master as of 2026-08-05
         with:
           toolchain: "1.96.0"
       - name: Validate frozen acceptance ledger
@@ -56,7 +56,7 @@ jobs:
           )
           PY
       - name: Save Rust evidence for aggregate job
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: checkpoint-fragments/
           key: checkpoint-transfer-${{ github.run_id }}-rust
@@ -69,14 +69,14 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_PROFILE_DEV_DEBUG: 0
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@master
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master as of 2026-08-05
         with:
           toolchain: "1.96.0"
-      - uses: astral-sh/setup-uv@v9.0.0
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - name: Build and prove isolated same-SHA wheel
@@ -100,7 +100,7 @@ jobs:
           )
           PY
       - name: Save Python evidence for aggregate job
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: checkpoint-fragments/
           key: checkpoint-transfer-${{ github.run_id }}-python
@@ -113,14 +113,14 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_PROFILE_DEV_DEBUG: 0
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@master
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master as of 2026-08-05
         with:
           toolchain: "1.96.0"
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
       - name: Build and prove same-SHA Node package
         run: |
           pnpm install --frozen-lockfile
@@ -142,7 +142,7 @@ jobs:
           )
           PY
       - name: Save Node evidence for aggregate job
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: checkpoint-fragments/
           key: checkpoint-transfer-${{ github.run_id }}-node
@@ -153,18 +153,18 @@ jobs:
     needs: [rust, python, node]
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/cache/restore@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: checkpoint-fragments
           key: checkpoint-transfer-${{ github.run_id }}-rust
           fail-on-cache-miss: true
-      - uses: actions/cache/restore@v6
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: checkpoint-fragments
           key: checkpoint-transfer-${{ github.run_id }}-python
           fail-on-cache-miss: true
-      - uses: actions/cache/restore@v6
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: checkpoint-fragments
           key: checkpoint-transfer-${{ github.run_id }}-node

.github/workflows/clean-env-verify.yml

@@ -34,17 +34,16 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
 
-      - uses: dtolnay/rust-toolchain@master
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master as of 2026-08-05
         with:
           toolchain: "1.96.0"