chore(security): auto-pin GitHub Actions to SHAs

.github/workflows/codeql-reusable.yml

@@ -45,26 +45,26 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
           packs: codeql/${{ matrix.language }}-queries
           config: ${{ vars.CODEQL_ORG_CONFIG }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           category: "/language:${{ matrix.language }}"
           upload: always
           output: sarif-results
 
       - name: Upload results artifact
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: codeql-results-${{ matrix.language }}
           path: sarif-results/${{ matrix.language }}.sarif

.github/workflows/codeql.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   codeql:
     name: CodeQL Analysis
-    uses: huggingface/security-workflows/.github/workflows/codeql-reusable.yml@v1.2.0
+    uses: huggingface/security-workflows/.github/workflows/codeql-reusable.yml@e0d40aaf3c566a5e820787840453f45f909e337f # v1.2.0
     permissions:
       security-events: write
       packages: read

.github/workflows/manual-create-release.yml

@@ -17,12 +17,12 @@
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Release
         uses: huggingface/semver-release-action@1.1.1
         id: semantic
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -46,4 +46,4 @@
         run: |
           echo "## No Release Published" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "No changes detected that warrant a new release." >> $GITHUB_STEP_SUMMARY
+          echo "No changes detected that warrant a new release." >> $GITHUB_STEP_SUMMARY

.github/workflows/octoscan-reusable.yml

@@ -38,27 +38,27 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Octoscan
         id: octoscan
-        uses: synacktiv/action-octoscan@v1
+        uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0
         with:
           disable_rules: ${{ inputs.disable_rules }}
           filter_triggers: ${{ inputs.filter_triggers }}
 
       - name: Upload SARIF to Security tab
         if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3.35.5
         with:
           sarif_file: "${{ steps.octoscan.outputs.sarif_output }}"
           category: octoscan
 
       - name: Upload results artifact
         if: always() && inputs.generate_summary
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: octoscan-results
           path: results.json
           retention-days: 30
-          if-no-files-found: ignore
+          if-no-files-found: ignore

.github/workflows/permissions-advisor-reusable.yml

@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Advisor
-        uses: GitHubSecurityLab/actions-permissions/advisor@v1
+        uses: GitHubSecurityLab/actions-permissions/advisor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0.2-beta9
         with:
           name: ${{ inputs.workflow_name }}
-          count: ${{ inputs.run_count }}
+          count: ${{ inputs.run_count }}

.github/workflows/semantic-create-release-and-update-major.yml

@@ -16,12 +16,12 @@
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Release
         uses: huggingface/semver-release-action@latest
         id: semantic
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/update-major-version-tag.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -44,4 +44,4 @@ jobs:
         run: |
           git tag -f ${{ inputs.major_tag }} ${{ inputs.source_tag }}
           git push origin ${{ inputs.major_tag }} --force
-          echo "Tag ${{ inputs.major_tag }} has been created and redirect to ${{ inputs.source_tag }}"
+          echo "Tag ${{ inputs.major_tag }} has been created and redirect to ${{ inputs.source_tag }}"

.pinact.yaml

@@ -0,0 +1,11 @@
+version: 3
+
+# Self-pin: this repo eats its own dog food.
+# Every `uses:` in our own workflows must be pinned to a 40-char SHA.
+
+files:
+  - pattern: .github/workflows/*.yml
+  - pattern: .github/workflows/*.yaml
+
+min_age:
+  value: 7  # refuse adopting a release younger than 7 days