Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/build.yml

@@ -36,7 +36,7 @@ jobs:
           #     target: aarch64-unknown-linux-musl
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Rust Tool Chain setup
         uses: dtolnay/rust-toolchain@stable
@@ -51,7 +51,7 @@ jobs:
         run: cargo build --release --target ${{ matrix.target }}
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: pet-${{ matrix.target }}
           path: target/${{ matrix.target }}/release/pet*

.github/workflows/coverage-baseline.yml

@@ -26,10 +26,10 @@ jobs:
             target: x86_64-pc-windows-msvc
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set Python to PATH
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -135,7 +135,7 @@ jobs:
         shell: bash
 
       - name: Install Pixi
-        uses: prefix-dev/setup-pixi@v0.8.1
+        uses: prefix-dev/setup-pixi@ba3bb36eb2066252b2363392b7739741bb777659 # v0.8.1
         with:
           run-install: false
 
@@ -194,7 +194,7 @@ jobs:
         shell: bash
 
       - name: Upload Coverage Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-baseline-${{ matrix.os }}
           path: lcov.info

.github/workflows/coverage.yml

@@ -31,10 +31,10 @@ jobs:
             comment_header: coverage-windows
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Post Coverage Started Comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           header: ${{ matrix.comment_header }}
           message: |
@@ -45,7 +45,7 @@ jobs:
             Comparing against exact base `${{ github.event.pull_request.base.sha }}`.
 
       - name: Set Python to PATH
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -151,7 +151,7 @@ jobs:
         shell: bash
 
       - name: Install Pixi
-        uses: prefix-dev/setup-pixi@v0.8.1
+        uses: prefix-dev/setup-pixi@ba3bb36eb2066252b2363392b7739741bb777659 # v0.8.1
         with:
           run-install: false
 
@@ -202,7 +202,7 @@ jobs:
 
       - name: Upload PR Coverage Artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-pr-${{ matrix.os }}
           path: lcov.info
@@ -225,7 +225,7 @@ jobs:
 
       - name: Download Exact PR Base Coverage
         if: always() && steps.wait_for_base_coverage.outcome == 'success'
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
         with:
           workflow: coverage-baseline.yml
           commit: ${{ github.event.pull_request.base.sha }}
@@ -248,7 +248,7 @@ jobs:
 
       - name: Post Coverage Comment
         if: always()
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           header: ${{ matrix.comment_header }}
           path: coverage-report.md

.github/workflows/lint.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Rust Tool Chain setup
         uses: dtolnay/rust-toolchain@stable
@@ -39,7 +39,7 @@ jobs:
           - macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Rust Tool Chain setup
         uses: dtolnay/rust-toolchain@stable

.github/workflows/perf-baseline.yml

@@ -28,10 +28,10 @@ jobs:
             target: x86_64-apple-darwin
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set Python to PATH
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -111,7 +111,7 @@ jobs:
         shell: bash
 
       - name: Upload Performance Baseline Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: perf-baseline-${{ matrix.os }}
           path: metrics.json

.github/workflows/perf-tests.yml

@@ -36,11 +36,11 @@ jobs:
             comment_header: perf-macos
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Post In-Progress Comment
         if: github.event_name == 'pull_request'
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           header: ${{ matrix.comment_header }}
           message: |
@@ -49,7 +49,7 @@ jobs:
             Running performance tests against baseline `${{ github.event.pull_request.base.sha }}`.
 
       - name: Set Python to PATH
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -122,7 +122,7 @@ jobs:
 
       - name: Upload PR Performance Results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: perf-pr-${{ matrix.os }}
           path: metrics.json
@@ -147,7 +147,7 @@ jobs:
         if: >-
           always() && github.event_name == 'pull_request' &&
           steps.wait_for_base_performance.outcome == 'success'
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
         with:
           workflow: perf-baseline.yml
           commit: ${{ github.event.pull_request.base.sha }}
@@ -159,7 +159,7 @@ jobs:
 
       - name: Download Main Performance for Manual Run
         if: always() && github.event_name == 'workflow_dispatch'
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
         with:
           workflow: perf-baseline.yml
           branch: main
@@ -182,7 +182,7 @@ jobs:
 
       - name: Post Performance Comment
         if: always() && github.event_name == 'pull_request'
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           header: ${{ matrix.comment_header }}
           path: performance-report.md

.github/workflows/pr-check.yml

@@ -40,10 +40,10 @@ jobs:
             run_cli: "yes"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set Python to PATH
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -170,7 +170,7 @@ jobs:
 
       # region Pixi
       - name: Install Pixi
-        uses: prefix-dev/setup-pixi@v0.8.1
+        uses: prefix-dev/setup-pixi@ba3bb36eb2066252b2363392b7739741bb777659 # v0.8.1
         with:
           run-install: false
 
@@ -242,26 +242,26 @@ jobs:
             target: x86_64-pc-windows-msvc
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # region Setup Poetry
       - name: Set Python 3.x to PATH
         if: startsWith( matrix.feature, 'ci-poetry')
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Set Python 3.12 to PATH
         if: startsWith( matrix.feature, 'ci-poetry')
         id: setupPython312
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Set Python 3.11 to PATH
         if: startsWith( matrix.feature, 'ci-poetry')
         id: setupPython311
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 
@@ -282,23 +282,23 @@ jobs:
 
       - name: Install Poetry (envs globally)
         if: startsWith( matrix.feature, 'ci-poetry-global')
-        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
+        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b # v1.3.4
         with:
           virtualenvs-create: true
           virtualenvs-in-project: false
           installer-parallel: true
 
       - name: Install Poetry (env locally)
         if: startsWith( matrix.feature, 'ci-poetry-project')
-        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
+        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b # v1.3.4
         with:
           virtualenvs-create: true
           virtualenvs-in-project: true
           installer-parallel: true
 
       - name: Install Poetry (env locally)
         if: startsWith( matrix.feature, 'ci-poetry-custom')
-        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
+        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b # v1.3.4
         with:
           virtualenvs-create: true
           virtualenvs-in-project: false
@@ -408,7 +408,7 @@ jobs:
             target: x86_64-unknown-linux-musl
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Homebrew
       - name: Homebrew Python
@@ -471,7 +471,7 @@ jobs:
           #     target: aarch64-unknown-linux-musl
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Rust Tool Chain setup
         uses: dtolnay/rust-toolchain@stable
@@ -494,7 +494,7 @@ jobs:
         shell: bash
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: pet-${{ matrix.target }}
           path: target/${{ matrix.target }}/release/pet*