Pin workflow actions to commit SHAs

.github/actions/msvc-env/action.yml

@@ -0,0 +1,25 @@
+name: MSVC x64 environment
+description: Load vcvars64 into the job environment so Ninja can find cl.exe.
+
+# Replaces ilammy/msvc-dev-cmd, which is stalled on Node 20. Only variables
+# that vcvars64.bat adds or changes are exported to later steps.
+runs:
+  using: composite
+  steps:
+    - shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+        $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+        $vs = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+        $bat = Join-Path "$vs" 'VC\Auxiliary\Build\vcvars64.bat'
+        if (-not $vs -or -not (Test-Path $bat)) { throw "vcvars64.bat not found (VS: '$vs')" }
+
+        $before = @{}
+        Get-ChildItem env: | ForEach-Object { $before[$_.Name] = $_.Value }
+        $after = cmd /c "`"$bat`" >nul && set"
+        if ($LASTEXITCODE -ne 0) { throw "vcvars64.bat failed ($LASTEXITCODE)" }
+
+        $after | ForEach-Object {
+          if ($_ -match '^([^=]+)=(.*)$' -and $before[$Matches[1]] -cne $Matches[2]) { "$($Matches[1])=$($Matches[2])" }
+        } | Out-File -Append -Encoding utf8 $env:GITHUB_ENV
+        Write-Host "Loaded MSVC x64 environment from $vs"

.github/workflows/bindings-sysman-python-checks.yml

@@ -40,10 +40,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 

.github/workflows/bindings-sysman-python-security-scan.yml

@@ -37,10 +37,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.x'
 
@@ -55,7 +55,7 @@ jobs:
           bandit -r source/ test/ -ll -f screen
 
       - name: Upload Bandit results as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: bandit-security-report

.github/workflows/bindings-sysman-python-unit-tests-coverage.yml

@@ -40,12 +40,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # Full history for better coverage comparison
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -285,7 +285,7 @@ jobs:
           fi
 
       - name: Upload Test Results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: test-results-${{ github.run_number }}
@@ -298,7 +298,7 @@ jobs:
           retention-days: 30
 
       - name: Upload Coverage Reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: coverage-report-${{ github.run_number }}

.github/workflows/build-clang.yml

@@ -27,7 +27,7 @@ jobs:
         run: |
           apt-get update
           apt-get install -y clang cmake make git
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build Loader (${{ matrix.build_type }}) with Clang on ${{ matrix.container }}
         run: |
           mkdir build

.github/workflows/build-msi-package.yml

@@ -12,11 +12,9 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./.github/actions/msvc-env
       - name: Build Loader on Latest Windows
         run: |
           mkdir build

.github/workflows/build-multi-static.yml

@@ -19,7 +19,7 @@ jobs:
       short-sha: ${{ steps.const.outputs.short-sha }}
       ref-slug: ${{ steps.const.outputs.ref-slug }}
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -86,15 +86,15 @@ jobs:
         image-name=ghcr.io/${{ github.repository }}/${OS_STRING}
         ccache-dir=${CCACHE_DIR}
         EOF
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Create Ccache directory
       run: mkdir -p '${{ steps.const.outputs.ccache-dir }}'
     - name: Ccache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.const.outputs.ccache-dir }}
         key: ccache-${{ github.job }}-${{ steps.const.outputs.os-string }}${{ env.ARCH_SUFFIX }}-${{ matrix.target }}-${{ github.sha }}
@@ -137,9 +137,7 @@ jobs:
         done
     - name: Setup Windows build environment
       if: matrix.os.name == 'windows'
-      uses: ilammy/msvc-dev-cmd@v1
-      with:
-        arch: x64
+      uses: ./.github/actions/msvc-env
     - name: Build (Windows)
       if: matrix.os.name == 'windows'
       run: |

.github/workflows/build-multi.yml

@@ -19,7 +19,7 @@ jobs:
       short-sha: ${{ steps.const.outputs.short-sha }}
       ref-slug: ${{ steps.const.outputs.ref-slug }}
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -104,15 +104,15 @@ jobs:
         image-name=ghcr.io/${{ github.repository }}/${OS_STRING}
         ccache-dir=${CCACHE_DIR}
         EOF
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Create Ccache directory
       run: mkdir -p '${{ steps.const.outputs.ccache-dir }}'
     - name: Ccache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.const.outputs.ccache-dir }}
         key: ccache-${{ github.job }}-${{ steps.const.outputs.os-string }}${{ env.ARCH_SUFFIX }}-${{ matrix.target }}-${{ github.sha }}
@@ -162,9 +162,7 @@ jobs:
         done
     - name: Setup Windows build environment
       if: matrix.os.name == 'windows'
-      uses: ilammy/msvc-dev-cmd@v1
-      with:
-        arch: x64
+      uses: ./.github/actions/msvc-env
     - name: Build (Windows)
       if: matrix.os.name == 'windows'
       run: |

.github/workflows/build-quick-static-n-1.yml

@@ -14,15 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Use ccache-action for ccache setup and caching
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           path: pr
-      - uses: hendrikmuhs/ccache-action@v1
+      - uses: hendrikmuhs/ccache-action@f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
 
       # Checkout master branch for static loader source
       - name: Checkout master branch for static loader
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
           fetch-depth: 0
@@ -73,23 +73,21 @@ jobs:
     runs-on: windows-latest
     steps:
       # Checkout PR branch (dynamic loader source)
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           path: pr
 
       # Checkout master branch for static loader source
       - name: Checkout master branch for static loader
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
           fetch-depth: 0
           path: master
 
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./pr/.github/actions/msvc-env
 
       # Build static loader from master branch
       - name: Build Static Loader from master

.github/workflows/build-quick-static.yml

@@ -12,8 +12,8 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [ubuntu-latest]
     steps:
-      - uses: actions/checkout@v7
-      - uses: hendrikmuhs/ccache-action@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: hendrikmuhs/ccache-action@f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
       - name: Build Static Loader on Latest Ubuntu
         run: |
           mkdir build
@@ -48,11 +48,9 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./.github/actions/msvc-env
       - name: Build Static Loader on Latest Windows
         run: |
           mkdir build

.github/workflows/build-quick.yml

@@ -31,7 +31,7 @@ jobs:
             apt-get update
             apt-get install -y build-essential cmake git
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build Loader on ${{ matrix.container }}
         run: |
           mkdir build
@@ -71,11 +71,9 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./.github/actions/msvc-env
       - name: Build Loader on Latest Windows
         run: |
           mkdir build

.github/workflows/check-abi.yml

@@ -16,21 +16,21 @@ jobs:
       run: |
         sudo apt update
         sudo apt install -y elfutils universal-ctags vtable-dumper
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0 # Required due to the way Git works, without it this action won't be able to find any or the correct tags
-    - uses: actions-ecosystem/action-get-latest-tag@v1
+    - uses: actions-ecosystem/action-get-latest-tag@b7c32daec3395a9616f88548363a42652b22d435 # v1.6.0
       id: get-latest-tag
       with:
         semver_only: true
     - name: Checkout base
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ steps.get-latest-tag.outputs.tag }}
         clean: true
         path: base
     - name: Checkout head
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         path: head
@@ -78,7 +78,7 @@ jobs:
           -old base.dump \
           -new head.dump \
           -report-path release_report.html
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: always()
       with:
         name: abi-report-last-release
@@ -92,13 +92,13 @@ jobs:
         sudo apt update
         sudo apt install -y elfutils universal-ctags vtable-dumper
     - name: Checkout base
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ github.base_ref }}
         clean: true
         path: base
     - name: Checkout head
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         path: head
@@ -146,7 +146,7 @@ jobs:
           -old base.dump \
           -new head.dump \
           -report-path master_report.html
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: always()
       with:
         name: abi-report-master

.github/workflows/codespell-comment.yml

@@ -27,14 +27,14 @@ jobs:
     if: github.event.workflow_run.event == 'pull_request'
     steps:
     - name: Download report
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       continue-on-error: true
       with:
         name: codespell-report
         run-id: ${{ github.event.workflow_run.id }}
         github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Post or update PR comment
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const fs = require('fs');

.github/workflows/codespell.yml

@@ -19,8 +19,8 @@ jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-python@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.x'
     - name: Install codespell
@@ -40,7 +40,7 @@ jobs:
       run: echo "${{ github.event.number }}" > pr_number.txt
     - name: Upload report
       # Consumed by the "Codespell Comment" workflow to post the PR comment.
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: codespell-report
         path: |