fix: pin inputs

[viyatb-oai]

Summary

• Pin Rust git patch dependencies to immutable revisions and make cargo-deny reject unknown git and registry sources unless explicitly allowlisted.
• Add checked-in SHA-256 coverage for the current rusty_v8 release assets, wire those hashes into Bazel, and verify CI override downloads before use.
• Add rusty_v8 MODULE.bazel update/check tooling plus a Bazel CI guard so future V8 bumps cannot drift from the checked-in checksum manifest.
• Pin release/lint cargo installs and all external GitHub Actions refs to immutable inputs.

Future V8 bump flow

Run these after updating the resolved v8 crate version and checksum manifest:

python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
python3 .github/scripts/rusty_v8_bazel.py check-module-bazel

The update command rewrites the matching rusty_v8_<crate_version> http_file SHA-256 values in MODULE.bazel from third_party/v8/rusty_v8_<crate_version>.sha256. The check command is also wired into Bazel CI to block drift.

Notes

• This intentionally excludes RustSec dependency upgrades and bubblewrap-related changes per request.
• The branch was rebased onto the latest origin/main before opening the PR.

Validation

• cargo fetch --locked
• cargo deny check advisories
• cargo deny check
• cargo deny check sources
• python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
• python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
• python3 -m unittest discover -s .github/scripts -p 'test_rusty_v8_bazel.py'
• python3 -m py_compile .github/scripts/rusty_v8_bazel.py .github/scripts/rusty_v8_module_bazel.py .github/scripts/test_rusty_v8_bazel.py
• repo-wide GitHub Actions uses: audit: all external action refs are pinned to 40-character SHAs
• yq eval on touched workflows and local actions
• git diff --check
• just bazel-lock-check

Hash verification

• Confirmed MODULE.bazel hashes match third_party/v8/rusty_v8_146_4_0.sha256.
• Confirmed GitHub release asset digests for denoland/rusty_v8 v146.4.0 and openai/codex rusty-v8-v146.4.0 match the checked-in hashes.
• Streamed and SHA-256 hashed all 10 MODULE.bazel rusty_v8 asset URLs locally; every downloaded byte stream matched both MODULE.bazel and the checked-in manifest.

Pin verification

• Confirmed signing-action pins match the peeled commits for their tag comments: sigstore/cosign-installer@v3.7.0, azure/login@v2, and azure/trusted-signing-action@v0.
• Pinned the remaining tag-based action refs in Bazel CI/setup: actions/setup-node@v6, facebook/install-dotslash@v2, bazelbuild/setup-bazelisk@v3, and actions/cache/restore@v5.
• Normalized all bazelbuild/setup-bazelisk@v3 refs to the peeled commit behind the annotated tag.
• Audited Cargo git dependencies: every manifest git dependency uses rev only, every Cargo.lock git source has ?rev=<sha>#<same-sha>, and cargo deny check sources passes with required-git-spec = "rev".
• Shallow-fetched each distinct git dependency repo at its pinned SHA and verified Git reports each object as a commit.

[bolinfest]

Mostly small comments except for the shared action bit.