ci: lint workflows and pin third-party actions to SHAs

.github/workflows/ci.yml

@@ -10,6 +10,10 @@ permissions:
   contents: read
 
 jobs:
+  workflow-lint:
+    name: Workflow lint
+    uses: wrightkit/.github/.github/workflows/actionlint.yml@main
+
   paths:
     name: Detect paths
     runs-on: ubuntu-latest
@@ -23,7 +27,7 @@ jobs:
       agent_guide: ${{ steps.filter.outputs.agent_guide }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -35,7 +39,7 @@ jobs:
 
       - name: Filter paths
         id: filter
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             rust_core:
@@ -79,10 +83,10 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout skills
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wrightkit/skills
           fetch-depth: 0
@@ -109,7 +113,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
@@ -121,7 +125,7 @@ jobs:
         run: cargo build --locked -p wright-cli
 
       - name: Upload CLI artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wright-cli-linux-stable-debug
           path: target/debug/wright
@@ -160,17 +164,17 @@ jobs:
             expected_exit: 0
     steps:
       - name: Checkout Wright
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout workshop-rs
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wrightkit/workshop-rs
           ref: f1f3c58f790e9aede9300ca6421698f2503f5f62 # v0.3.11
           path: workshop-rs-pinned
 
       - name: Download CLI artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: wright-cli-linux-stable-debug
           path: target/debug
@@ -241,15 +245,15 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
         with:
           toolchain: 1.97.1
           cache-shared-key: linux-quality-stable-dev-test
       - name: Download CLI artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: wright-cli-linux-stable-debug
           path: target/debug
@@ -285,7 +289,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout Wright
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
@@ -297,7 +301,7 @@ jobs:
       # commit the integration tests were validated against (merged LPP v1,
       # PR wrightkit/language-provider-protocol#2 plus docs-only follow-ups).
       - name: Checkout LPP
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wrightkit/language-provider-protocol
           ref: 416b293e26e6fb2d29061608a493a7aecd2ce14f
@@ -325,15 +329,15 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
         with:
           toolchain: 1.97.1
 
       - name: Download CLI artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: wright-cli-linux-stable-debug
           path: target/debug
@@ -353,7 +357,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
@@ -370,7 +374,7 @@ jobs:
 
       - name: Upload benchmark report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: benchmark-report
           path: target/wright-bench-report.json
@@ -396,10 +400,10 @@ jobs:
           - overwatch-ai-pve
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download CLI artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: wright-cli-linux-stable-debug
           path: target/debug
@@ -415,7 +419,7 @@ jobs:
             --out "$RUNNER_TEMP/${{ matrix.project }}.json"
 
       - name: Upload shard run
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: metrics-shard-${{ matrix.project }}
           path: ${{ runner.temp }}/${{ matrix.project }}.json
@@ -429,10 +433,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download shard runs
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: metrics-shard-*
           merge-multiple: true
@@ -454,10 +458,10 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download CLI artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: wright-cli-linux-stable-debug
           path: target/debug
@@ -472,7 +476,7 @@ jobs:
 
       - name: Upload latency record
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: metrics-latency
           path: target/metrics-latency.json
@@ -493,7 +497,7 @@ jobs:
           - windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
@@ -508,7 +512,7 @@ jobs:
         run: cargo build --locked -p wright-cli -p wright-lsp
 
       - name: Upload distribution binaries
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wright-dist-cli-${{ matrix.os }}
           path: |
@@ -542,10 +546,10 @@ jobs:
             channel: WinGet
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
 
@@ -560,7 +564,7 @@ jobs:
         run: winget settings --enable LocalManifestFiles
 
       - name: Download distribution binaries
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: wright-dist-cli-${{ matrix.os }}
           path: target/debug
@@ -605,7 +609,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Rust
         uses: wrightkit/.github/.github/actions/setup-rust@main
@@ -614,7 +618,7 @@ jobs:
           cache-shared-key: linux-wasm-stable-release
 
       - name: Set up Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm
@@ -645,6 +649,7 @@ jobs:
     if: always()
     needs:
       - paths
+      - workflow-lint
       - rust-quality
       - wright-cli-build
       - workshop-integration
@@ -661,7 +666,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Fail on failed, cancelled, or wrongly skipped jobs
         env:

.github/workflows/release-please.yml

@@ -22,15 +22,15 @@ jobs:
     steps:
       - name: Run release-please
         id: release
-        uses: googleapis/release-please-action@v5
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           token: ${{ secrets.GH_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
       - name: Check out Release PR branch
         if: steps.release.outputs.prs_created == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
           token: ${{ secrets.GH_TOKEN }}