ci: add Logic AU input regression smoke and clean vendor-fork workflows

.github/workflows/build.yml

@@ -1,21 +1,32 @@
-name: Automated Builds
+name: Integration Builds
 
 on:
   push:
-    branches:
-      - '**'
-    tags:
-      - '*'
-  pull_request:
     branches:
       - master
   workflow_dispatch:
 
+# The real PR contract is covered by Tests (including a macOS AU host smoke).
+# This full example-package matrix is an integration check for master or an
+# operator-requested diagnostic, not a per-feature-branch artifact factory.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 defaults:
   run:
     # This otherwise gets run under dash which does not support brace expansion
     shell: bash
 
+env:
+  # See the note in `test.yml`: `portable_simd` is unstable and current
+  # nightlies no longer resolve `std::simd::{LaneCount, SupportedLaneCount}`.
+  # Keep this in sync with `test.yml`.
+  NIGHTLY_TOOLCHAIN: nightly-2025-01-01
+
 jobs:
   # We'll only package the plugins with an entry in bundler.toml
   package:
@@ -28,7 +39,7 @@ jobs:
     name: Package plugin binaries
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Fetch all git history
         run: git fetch --force --prune --tags --unshallow
 
@@ -38,29 +49,32 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libasound2-dev libgl-dev libjack-dev libx11-xcb-dev  libxcb1-dev libxcb-dri2-0-dev libxcb-icccm4-dev libxcursor-dev libxkbcommon-dev libxcb-shape0-dev libxcb-xfixes0-dev
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         # FIXME: Caching `target/` causes the Windows runner to blow up after some time
         if: startsWith(matrix.os, 'windows')
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
-      - uses: actions/cache@v4
+          key: package-${{ matrix.name }}-${{ matrix.cross-target }}-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: package-${{ matrix.name }}-${{ matrix.cross-target }}-${{ env.NIGHTLY_TOOLCHAIN }}-
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         if: "!startsWith(matrix.os, 'windows')"
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
+          key: package-${{ matrix.name }}-${{ matrix.cross-target }}-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: package-${{ matrix.name }}-${{ matrix.cross-target }}-${{ env.NIGHTLY_TOOLCHAIN }}-
 
       - name: Set up Rust toolchain
         # Needed for SIMD
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
         with:
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
           # The macOS AArch64 build is done from an x86_64 macOS CI runner, so
           # it needs to be cross compiled
           targets: ${{ matrix.cross-target }}
@@ -88,17 +102,21 @@ jobs:
           fi
 
       - name: Determine build archive name
+        if: github.event_name == 'workflow_dispatch'
         run: |
           # Windows (usually) doesn't like colons in file names
           echo "ARCHIVE_NAME=nih-plugs-$(date -u +"%Y-%m-%d-%H%m%S")-${{ matrix.name }}" >> "$GITHUB_ENV"
       - name: Move all packaged plugin into a directory
+        if: github.event_name == 'workflow_dispatch'
         run: |
           # GitHub Action strips the top level directory, great, have another one
           mkdir -p "$ARCHIVE_NAME/$ARCHIVE_NAME"
           mv target/bundled/* "$ARCHIVE_NAME/$ARCHIVE_NAME"
       - name: Add an OS-specific readme file with installation instructions
+        if: github.event_name == 'workflow_dispatch'
         run: cp ".github/workflows/readme-${{ runner.os }}.txt" "$ARCHIVE_NAME/$ARCHIVE_NAME/README.txt"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: github.event_name == 'workflow_dispatch'
         with:
           name: ${{ env.ARCHIVE_NAME }}
           path: ${{ env.ARCHIVE_NAME }}

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  schedule:
+    - cron: '23 3 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+          - rust
+    permissions:
+      contents: read
+      packages: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      # Rust and GitHub Actions support build-mode none. This covers the full
+      # tracked source and workflow tree without duplicating the expensive
+      # build/test jobs.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-and-quality
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/docs.yml

@@ -1,21 +1,34 @@
-name: Docs
+name: Documentation
 
 on:
   push:
     branches:
       - master
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 
 defaults:
   run:
     # This otherwise gets run under dash which does not support brace expansion
     shell: bash
 
+env:
+  # See the note in `test.yml`. Keep this in sync with the other workflows.
+  NIGHTLY_TOOLCHAIN: nightly-2025-01-01
+
 jobs:
   docs:
     name: Generate and upload docs
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       # Needed for git-describe to do anything useful
       - name: Fetch all git history
         run: git fetch --force --prune --tags --unshallow
@@ -25,29 +38,25 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libasound2-dev libgl-dev libjack-dev libx11-xcb-dev  libxcb1-dev libxcb-dri2-0-dev libxcb-icccm4-dev libxcursor-dev libxkbcommon-dev libxcb-shape0-dev libxcb-xfixes0-dev
 
-      - uses: actions/cache@v4
-        # FIXME: Caching `target/` causes the Windows runner to blow up after some time
-        if: startsWith(matrix.os, 'windows')
-        with:
-          path: |
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
-      - uses: actions/cache@v4
-        if: "!startsWith(matrix.os, 'windows')"
+      # This job has no matrix, but both cache steps were keyed on
+      # `${{ matrix.name }}-${{ matrix.cross-target }}` and gated on
+      # `matrix.os`, so the key was always the literal `-`.
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
+          key: docs-ubuntu-22.04-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: docs-ubuntu-22.04-${{ env.NIGHTLY_TOOLCHAIN }}-
 
       - name: Set up Rust toolchain
         # Nightly is needed to document the SIMD feature and for the
         # `doc_auto_cfg` feature
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
       - name: Generate documentation for all targets
         # Don't use --all-features here as that will enable a whole bunch of
         # conflicting iced features. We also don't want to use `--workspace`
@@ -67,13 +76,3 @@ jobs:
           <meta charset="utf-8">
           <meta http-equiv="refresh" content="0; url=nih_plug">
           EOF
-      - name: Deploy to GitHub Pages
-        uses: JamesIves/github-pages-deploy-action@v4.3.0
-        with:
-          branch: gh-pages
-          folder: target/doc
-
-          # Having the gh-pages branch on this repository adds a whole bunch of
-          # noise to the GitHub feed if you follow this repo
-          repository-name: robbert-vdh/nih-plug-docs
-          ssh-key: ${{ secrets.DOCS_DEPLOY_KEY }}