From 5923e4f5895248126d44079a0f98c89e5333787e Mon Sep 17 00:00:00 2001
From: Pim Feltkamp <48278217+pimfeltkamp@users.noreply.github.com>
Date: Wed, 4 Nov 2026 01:55:12 +0100
Subject: [PATCH] Security: pin GitHub Actions in release and CI workflows to
 commit SHAs

The tag-triggered publish job holds CARGO_REGISTRY_TOKEN and contents: write
but ran dtolnay/rust-toolchain@stable (moving branch), softprops/action-gh-release@v3
(moving tag), actions/checkout@v6 and actions/cache@v5. A compromised action
could install a trojaned cargo that reads the token or tampers with the
published crate. ci.yml writes the same cargo cache the release job restores,
so its actions are pinned too.

Each pin resolves to the exact commit the old mutable ref pointed at today,
so no behaviour changes. Dependabot's github-actions entry keeps them updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/ci.yml      | 6 +++---
 .github/workflows/release.yml | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0eef918..d22d0b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,15 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
 
       - name: Cache cargo
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ffa053d..73716fa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,13 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
 
       - name: Cache cargo
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -54,7 +54,7 @@ jobs:
         run: cargo publish
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           generate_release_notes: true
           prerelease: ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }}