From 6830dd05f2312145c2ee3dc552120bb6a914cfca Mon Sep 17 00:00:00 2001
From: lukasWuttke <54042461+LukasWodka@users.noreply.github.com>
Date: Wed, 5 Aug 2026 20:27:37 +0200
Subject: [PATCH] sec(ci): pin actions/* refs to commit SHAs (backend#1491,
 D10) (#461)

Pin every actions/* ref to the full 40-char commit SHA it currently
resolves to, with a trailing exact-version comment (D10,
RFC-BACKEND-1405). Behaviour-preserving: no version changes, only
removal of silent tag mutation. tracebloc/* refs stay on @main by
design; third-party refs were pinned under backend#1490.

Part of tracebloc/backend#1491.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/add-to-kanban.yml          |  2 +-
 .github/workflows/backend-fixtures-drift.yml |  2 +-
 .github/workflows/build.yml                  | 22 ++++++++++----------
 .github/workflows/chart-drift.yml            |  6 +++---
 .github/workflows/e2e.yml                    |  8 +++----
 .github/workflows/golangci.yml               |  4 ++--
 .github/workflows/goldens-drift.yml          |  6 +++---
 .github/workflows/head-drift-canary.yml      |  6 +++---
 .github/workflows/install-path-persist.yml   |  4 ++--
 .github/workflows/mutation.yml               |  6 +++---
 .github/workflows/release.yml                | 10 ++++-----
 .github/workflows/stale-backlog.yml          |  2 +-
 .github/workflows/vulncheck.yml              |  4 ++--
 13 files changed, 41 insertions(+), 41 deletions(-)

diff --git a/.github/workflows/add-to-kanban.yml b/.github/workflows/add-to-kanban.yml
index 28640d55..603751a0 100644
--- a/.github/workflows/add-to-kanban.yml
+++ b/.github/workflows/add-to-kanban.yml
@@ -10,7 +10,7 @@ jobs:
   add-to-project:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           project-url: https://github.com/orgs/tracebloc/projects/2
           github-token: ${{ secrets.PROJECTS_KANBAN_TOKEN }}
diff --git a/.github/workflows/backend-fixtures-drift.yml b/.github/workflows/backend-fixtures-drift.yml
index 642f1b1d..0ab93a36 100644
--- a/.github/workflows/backend-fixtures-drift.yml
+++ b/.github/workflows/backend-fixtures-drift.yml
@@ -40,7 +40,7 @@ jobs:
     name: Backend fixtures drift check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: scripts/sync-backend-fixtures.sh --check
         env:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 379933c1..2bdd1cfd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,7 +32,7 @@ jobs:
     # (backend#1009).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: scripts/sync-schema.sh --check
         run: ./scripts/sync-schema.sh --check
 
@@ -46,7 +46,7 @@ jobs:
     # closed when cosign is absent (RFC-0001 R8, backend#889).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: shellcheck + dash parse
         run: |
           sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck dash
@@ -62,10 +62,10 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -93,10 +93,10 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -200,10 +200,10 @@ jobs:
     # published between PRs). Bump deliberately.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -243,10 +243,10 @@ jobs:
             arch: arm64
             ext: .exe
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -293,7 +293,7 @@ jobs:
           "$BIN" dataset push --help >/dev/null
 
       - name: Upload binary as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: tracebloc-${{ matrix.os }}-${{ matrix.arch }}
           path: dist/tracebloc-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}
diff --git a/.github/workflows/chart-drift.yml b/.github/workflows/chart-drift.yml
index 84c1e481..3312ddf3 100644
--- a/.github/workflows/chart-drift.yml
+++ b/.github/workflows/chart-drift.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout this CLI ref
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: cli
 
@@ -65,14 +65,14 @@ jobs:
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
       - name: Checkout tracebloc/client @ pinned ref
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: tracebloc/client
           ref: ${{ steps.pin.outputs.ref }}
           path: client
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: cli/go.mod
           cache: true
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index ac010920..6b711663 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -105,10 +105,10 @@ jobs:
       needs.changes.result == 'failure' ||
       needs.changes.outputs.e2e == 'true')
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -156,10 +156,10 @@ jobs:
       needs.changes.result == 'failure' ||
       needs.changes.outputs.e2e == 'true')
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/golangci.yml b/.github/workflows/golangci.yml
index fac2e595..da4d148a 100644
--- a/.github/workflows/golangci.yml
+++ b/.github/workflows/golangci.yml
@@ -44,10 +44,10 @@ jobs:
     # protection (backend#1305 / epic #930).
     # ==================================================================
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/goldens-drift.yml b/.github/workflows/goldens-drift.yml
index 39282b40..cf0d7f55 100644
--- a/.github/workflows/goldens-drift.yml
+++ b/.github/workflows/goldens-drift.yml
@@ -52,7 +52,7 @@ jobs:
     name: Validator goldens vs data-ingestors @ pin
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve the data-ingestors pin
         id: pin
@@ -125,7 +125,7 @@ jobs:
 
       - name: Checkout tracebloc/data-ingestors @ pin
         if: steps.access.outputs.ok == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: tracebloc/data-ingestors
           ref: ${{ steps.pin.outputs.ref }}
@@ -138,7 +138,7 @@ jobs:
 
       - name: Set up Python
         if: steps.access.outputs.ok == 'true'
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'   # matches data-ingestors' own CI
           cache: pip
diff --git a/.github/workflows/head-drift-canary.yml b/.github/workflows/head-drift-canary.yml
index 25c67016..e36bb7bf 100644
--- a/.github/workflows/head-drift-canary.yml
+++ b/.github/workflows/head-drift-canary.yml
@@ -47,7 +47,7 @@ jobs:
     name: Pin vs HEAD drift (advisory)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve the data-ingestors pin
         id: pin
@@ -89,7 +89,7 @@ jobs:
           echo "use_pat=$use_pat" >> "$GITHUB_OUTPUT"
 
       - name: Checkout tracebloc/data-ingestors @ develop HEAD
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: tracebloc/data-ingestors
           ref: develop
@@ -159,7 +159,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'   # matches data-ingestors' own CI
           cache: pip
diff --git a/.github/workflows/install-path-persist.yml b/.github/workflows/install-path-persist.yml
index 87b08ff9..82f993f4 100644
--- a/.github/workflows/install-path-persist.yml
+++ b/.github/workflows/install-path-persist.yml
@@ -59,13 +59,13 @@ jobs:
     steps:
       # 1. This PR's CLI source — we test THIS install.sh, not the released one.
       - name: Checkout this CLI PR
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: cli
 
       # 2. The fresh-shell harness from tracebloc/client (single source of truth).
       - name: Checkout the client path-persist harness
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: tracebloc/client
           ref: ${{ env.CLIENT_HARNESS_REF }}
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 21adeb91..edbe71b8 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -47,10 +47,10 @@ jobs:
     name: Mutation (${{ inputs.package }})
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -110,7 +110,7 @@ jobs:
 
       - name: Upload machine-readable report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: gremlins-report
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1f9c2b2..ab68e295 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -94,13 +94,13 @@ jobs:
             ext: .exe
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -190,7 +190,7 @@ jobs:
           cat "$BIN_NAME.sha256"
 
       - name: Upload per-matrix artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist-${{ matrix.os }}-${{ matrix.arch }}
           path: dist/
@@ -206,12 +206,12 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.ref }}
 
       - name: Download all matrix artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           path: dist/
           merge-multiple: true
diff --git a/.github/workflows/stale-backlog.yml b/.github/workflows/stale-backlog.yml
index 9b46fc31..4e424639 100644
--- a/.github/workflows/stale-backlog.yml
+++ b/.github/workflows/stale-backlog.yml
@@ -13,7 +13,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v11
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-issue-stale: 42  # 6 weeks of no activity → warning
           days-before-issue-close: 14  # +2 weeks of silence → close
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
index e467fb96..0a261b5c 100644
--- a/.github/workflows/vulncheck.yml
+++ b/.github/workflows/vulncheck.yml
@@ -33,12 +33,12 @@ jobs:
     name: govulncheck (develop)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: develop
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true