build: pin CI action SHAs and dev-tool versions

Pin every GitHub Actions `uses:` to a commit SHA with a `# vX.Y.Z` comment (keeps Renovate/Dependabot working), and pin the versions of the dev tools we install — cargo-audit, cargo-deny, cargo-nextest, cargo-fuzz, cargo-doc-md, cross, protoc, dprint, and Node — across all workflows and the Makefile.

OS packages installed via apt/brew (jq, netcat, shellcheck, musl-tools) are intentionally left unpinned: exact apt versions get garbage-collected from mirrors and break CI over time.

Author: LukeMathWalker

.github/workflows/bench.yml

@@ -14,25 +14,26 @@ jobs:
     name: Bench
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
         with:
           rustflags: ""
 
       - name: Install protoc
-        uses: arduino/setup-protoc@v3
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
         with:
+          version: "35.1"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Bench
         run: cargo bench --workspace --no-fail-fast -- --quick
 
       - name: Upload criterion reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: criterion-reports
           path: target/criterion/**

.github/workflows/ci.yml

@@ -16,18 +16,18 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - uses: cargo-bins/cargo-binstall@v1.20.0
-      - run: cargo binstall -y cargo-audit
+      - uses: cargo-bins/cargo-binstall@30b5ca8b54e1dcffd9548bc87ede1531310fdc67 # v1.20.0
+      - run: cargo binstall -y cargo-audit@0.22.2
       - run: cargo audit --deny warnings
 
   zizmor:
     name: Actions Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Install zizmor
@@ -41,40 +41,42 @@ jobs:
     name: Licenses & Bans
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - uses: EmbarkStudios/cargo-deny-action@v2
+      - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20
         with:
           command: check licenses bans sources
 
   trufflehog:
     name: Secret Scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: trufflesecurity/trufflehog@v3.95.5
+      - uses: trufflesecurity/trufflehog@d411fff7b8879a62509f3fa98c07f247ac089a51 # v3.95.5
         with:
           extra_args: --results=verified,unverified,unknown
 
   fmt:
     name: Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       # dprint formats TOML + Markdown + Rust via its exec plugin, which shells
       # out to rustfmt, so the toolchain must be present. setup-rust-toolchain
       # installs it from rust-toolchain.toml (including the rustfmt component).
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
         with:
           cache: false
           rustflags: ""
-      - uses: dprint/check@v2.3
+      - uses: dprint/check@9cb3a2b17a8e606d37aae341e49df3654933fc23 # v2.3
+        with:
+          dprint-version: "0.54.0"
 
   check:
     name: Check (${{ matrix.os }})
@@ -84,23 +86,24 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
 
       - name: Install protoc
-        uses: arduino/setup-protoc@v3
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
         with:
+          version: "35.1"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Clippy
         run: cargo clippy --workspace -- -D warnings
 
       - name: Install cargo-nextest
-        uses: cargo-bins/cargo-binstall@v1.20.0
-      - run: cargo binstall -y cargo-nextest
+        uses: cargo-bins/cargo-binstall@30b5ca8b54e1dcffd9548bc87ede1531310fdc67 # v1.20.0
+      - run: cargo binstall -y cargo-nextest@0.9.137
 
       - name: Test
         run: cargo nextest run --workspace
@@ -113,22 +116,23 @@ jobs:
     name: Fuzz targets (check)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - id: nightly
         run: echo "toolchain=$(cat .rust-nightly)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
         with:
           toolchain: ${{ steps.nightly.outputs.toolchain }}
           rustflags: ""
           cache-workspaces: fuzz -> fuzz/target
 
       - name: Install protoc
-        uses: arduino/setup-protoc@v3
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
         with:
+          version: "35.1"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check fuzz targets

.github/workflows/demo-e2e.yml

@@ -17,17 +17,18 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
         with:
           rustflags: ""
 
       - name: Install protoc
-        uses: arduino/setup-protoc@v3
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
         with:
+          version: "35.1"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install jq + netcat
@@ -58,7 +59,7 @@ jobs:
 
       - name: Upload demo logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: demo-logs
           path: examples/demo/logs/

.github/workflows/docs.yml

@@ -30,41 +30,42 @@ jobs:
     name: Build docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Install Rust nightly (required by cargo-doc-md)
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
         with:
           toolchain: nightly
           cache: false
           rustflags: ""
 
       - name: Install Rust (pinned in rust-toolchain.toml)
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
         with:
           rustflags: ""
           cache-shared-key: docs
 
       - name: Install protoc
-        uses: arduino/setup-protoc@v3
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
         with:
+          version: "35.1"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install cargo-doc-md
-        run: cargo install --locked cargo-doc-md
+        run: cargo install --locked --version 0.11.0 cargo-doc-md
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10.30.3
           run_install: false
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 24
+          node-version: "24.16.0"
           cache: pnpm
           cache-dependency-path: docs-site/pnpm-lock.yaml
           registry-url: https://registry.npmjs.org
@@ -81,7 +82,7 @@ jobs:
 
       - name: Upload Pages artifact
         if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_dispatch'
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: docs-site/dist
 
@@ -99,4 +100,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/fuzz.yml

@@ -18,29 +18,30 @@ jobs:
       matrix:
         target: [normalizer, paseto_verify, capability_seed, capability_seed_toml]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - id: nightly
         run: echo "toolchain=$(cat .rust-nightly)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
         with:
           toolchain: ${{ steps.nightly.outputs.toolchain }}
           rustflags: ""
           cache-workspaces: fuzz -> fuzz/target
 
       - name: Install protoc
-        uses: arduino/setup-protoc@v3
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
         with:
+          version: "35.1"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@v1.20.0
+        uses: cargo-bins/cargo-binstall@30b5ca8b54e1dcffd9548bc87ede1531310fdc67 # v1.20.0
 
       - name: Install cargo-fuzz
-        run: cargo binstall --no-confirm --locked cargo-fuzz
+        run: cargo binstall --no-confirm --locked cargo-fuzz@0.13.2
 
       - name: Run ${{ matrix.target }}
         env:

.github/workflows/installer-lint.yml

@@ -20,7 +20,7 @@ jobs:
     name: ShellCheck install.sh
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Install shellcheck
@@ -32,7 +32,7 @@ jobs:
     name: PSScriptAnalyzer install.ps1
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Install PSScriptAnalyzer

.github/workflows/installer-smoke.yml

@@ -21,7 +21,7 @@ jobs:
       matrix:
         runner: [ubuntu-latest, macos-13, macos-14]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Run install.sh (no-brew, no-init, no-modify-path)
@@ -52,7 +52,7 @@ jobs:
     name: install.ps1 (windows-latest)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Run install.ps1