From 71649293a32bbc71ee35a95cbf09e46d2726dcef Mon Sep 17 00:00:00 2001
From: Teakowa <git@teakowa.dev>
Date: Sun, 25 Oct 2026 06:32:49 +0800
Subject: [PATCH] ci: lint workflows and pin third-party actions to SHAs

Call the shared actionlint workflow from ci.yml so workflow changes are
linted in CI, and migrate every tag-pinned third-party action to a full
commit SHA with the resolved tag as a comment, per the ci-platform
mandate.

Refs wrightkit/.github#124
---
 .github/workflows/ci.yml          | 16 ++++++++++------
 .github/workflows/release-plz.yml |  8 ++++----
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eaff025f..2927ed56 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,10 @@ permissions:
   contents: read
 
 jobs:
+  workflow-lint:
+    name: Workflow lint
+    uses: wrightkit/.github/.github/workflows/actionlint.yml@main
+
   rust-quality:
     name: Rust (${{ matrix.toolchain }})
     strategy:
@@ -38,7 +42,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
@@ -65,7 +69,7 @@ jobs:
           --report target/opy-rs-compiler-report.json
 
       - name: Install pinned OverPy oracle
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 11.10.0
 
@@ -90,7 +94,7 @@ jobs:
 
       - name: Upload compiler compatibility report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: opy-rs-compiler-compatibility-report
           path: |
@@ -106,7 +110,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
@@ -131,7 +135,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
@@ -151,7 +155,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Assert the verified-R2-before-promotion release order
         run: python3 tools/verify-release-order.py
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 3ac44e2d..a24e21ea 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -62,7 +62,7 @@ jobs:
 
     steps:
       - name: Check out release source
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.release-context.outputs.opy_release_tag }}
 
@@ -99,7 +99,7 @@ jobs:
           fi
 
       - name: Stage provider artifact and checksum
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: opy-provider-${{ matrix.target }}
           path: |
@@ -118,7 +118,7 @@ jobs:
 
     steps:
       - name: Download all target artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: dist
 
@@ -162,7 +162,7 @@ jobs:
 
     steps:
       - name: Download all target artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: dist