From 6eb3903380cd85989cf74021c6673958c5ccd6aa Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 26 May 2026 19:19:37 +0900 Subject: [PATCH 1/3] security: pin GitHub Actions to SHA hashes Co-Authored-By: Yudai SUZUKI --- .github/workflows/check_misc.yml | 2 +- .github/workflows/labeler.yml | 2 +- .github/workflows/modgc.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/windows.yml | 2 +- .github/workflows/wsl.yml | 2 +- .github/workflows/zjit-macos.yml | 2 +- .github/workflows/zjit-ubuntu.yml | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/check_misc.yml b/.github/workflows/check_misc.yml index 543c54a3c9c679..7c7433ae1cc0d1 100644 --- a/.github/workflows/check_misc.yml +++ b/.github/workflows/check_misc.yml @@ -78,7 +78,7 @@ jobs: }} - name: Upload docs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: path: html name: ${{ steps.docs.outputs.htmlout }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index e57cd86e2b3c7f..deae44bafd1990 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -9,4 +9,4 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/labeler@v5 + - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0 diff --git a/.github/workflows/modgc.yml b/.github/workflows/modgc.yml index e7a1efe9d23743..ca694cfbf9640b 100644 --- a/.github/workflows/modgc.yml +++ b/.github/workflows/modgc.yml @@ -106,7 +106,7 @@ jobs: $SETARCH ../src/configure -C --disable-install-doc --with-modular-gc=${{ env.MODULAR_GC_DIR }} ${arch:+--target=$arch-$OSTYPE --host=$arch-$OSTYPE} - - uses: actions-rust-lang/setup-rust-toolchain@v1 + - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1 - name: Set MMTk environment variables run: | echo 'EXCLUDES=../src/test/.excludes-mmtk' >> $GITHUB_ENV diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 25916066d68697..a1e94aea522bf4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,9 +15,9 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0 with: ruby-version: 3.3.4 diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 21f23ab8995790..8dbccef90451eb 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -89,7 +89,7 @@ jobs: shell: pwsh - name: Export GitHub Actions cache environment variables - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || ''); diff --git a/.github/workflows/wsl.yml b/.github/workflows/wsl.yml index e6b4133b76946c..fe1325ad30fdbd 100644 --- a/.github/workflows/wsl.yml +++ b/.github/workflows/wsl.yml @@ -30,7 +30,7 @@ jobs: steps: - name: Install winget - uses: Cyberboss/install-winget@v1 + uses: Cyberboss/install-winget@1c6f189175e9f015bf1aa113cd1cc6c73efb9d47 # v1.1.1 - name: Install or update WSL uses: Ubuntu/WSL/.github/actions/wsl-install@main diff --git a/.github/workflows/zjit-macos.yml b/.github/workflows/zjit-macos.yml index 4a7a2fbf017df4..b31ea72996cbf8 100644 --- a/.github/workflows/zjit-macos.yml +++ b/.github/workflows/zjit-macos.yml @@ -74,7 +74,7 @@ jobs: # Set fetch-depth: 10 so that Launchable can receive commits information. fetch-depth: 10 - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@920ab1831fbf4fb3ef75c8ead83556c918bb7290 # v2.79.8 with: tool: nextest@0.9 if: ${{ matrix.test_task == 'zjit-test' }} diff --git a/.github/workflows/zjit-ubuntu.yml b/.github/workflows/zjit-ubuntu.yml index 2923fcf7bdd221..7d1c1513892bc0 100644 --- a/.github/workflows/zjit-ubuntu.yml +++ b/.github/workflows/zjit-ubuntu.yml @@ -78,7 +78,7 @@ jobs: ruby-version: '3.0' bundler: none - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@920ab1831fbf4fb3ef75c8ead83556c918bb7290 # v2.79.8 with: tool: nextest@0.9 if: ${{ matrix.test_task == 'zjit-test' }} From 0a891420ba032e7a4b595ff0ea4d4b426f4d3fd3 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Mon, 6 Jul 2026 09:58:07 +0000 Subject: [PATCH 2/3] ci: pin GitHub Actions with SHA via pinact Co-Authored-By: Yudai SUZUKI --- .github/workflows/cygwin.yml | 2 +- .github/workflows/macos.yml | 2 +- .github/workflows/wsl.yml | 10 +++++----- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/cygwin.yml b/.github/workflows/cygwin.yml index d822a2e9e217e3..c6a6dc95ebfd10 100644 --- a/.github/workflows/cygwin.yml +++ b/.github/workflows/cygwin.yml @@ -45,7 +45,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Setup Cygwin - uses: cygwin/cygwin-install-action@master + uses: cygwin/cygwin-install-action@3f0a3f9f988f7e96b8c18098ae05eaec175f5b52 # v6 with: packages: ruby gcc-core make autoconf libtool libssl-devel libyaml-devel libffi-devel zlib-devel diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 6220df9f568786..f9531e6244bb12 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -164,7 +164,7 @@ jobs: - name: Resolve job ID id: job_id - uses: actions/github-script@main + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: matrix: ${{ toJson(matrix) }} with: diff --git a/.github/workflows/wsl.yml b/.github/workflows/wsl.yml index fe1325ad30fdbd..fe8e22b8b65af5 100644 --- a/.github/workflows/wsl.yml +++ b/.github/workflows/wsl.yml @@ -33,12 +33,12 @@ jobs: uses: Cyberboss/install-winget@1c6f189175e9f015bf1aa113cd1cc6c73efb9d47 # v1.1.1 - name: Install or update WSL - uses: Ubuntu/WSL/.github/actions/wsl-install@main + uses: Ubuntu/WSL/.github/actions/wsl-install@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 with: distro: Ubuntu-24.04 - name: Install dependencies - uses: Ubuntu/WSL/.github/actions/wsl-bash@main + uses: Ubuntu/WSL/.github/actions/wsl-bash@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 with: distro: Ubuntu-24.04 working-dir: /tmp/github/ @@ -47,14 +47,14 @@ jobs: DEBIAN_FRONTEND=noninteractive sudo apt install -y ruby build-essential autoconf libssl-dev libyaml-dev zlib1g-dev libgmp-dev libffi-dev - name: Check out the repository - uses: Ubuntu/WSL/.github/actions/wsl-checkout@main + uses: Ubuntu/WSL/.github/actions/wsl-checkout@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 with: distro: Ubuntu-24.04 working-dir: /tmp/github/ submodules: true - name: Build - uses: Ubuntu/WSL/.github/actions/wsl-bash@main + uses: Ubuntu/WSL/.github/actions/wsl-bash@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 with: distro: Ubuntu-24.04 working-dir: /tmp/github/ @@ -66,7 +66,7 @@ jobs: make -j4 - name: Test - uses: Ubuntu/WSL/.github/actions/wsl-bash@main + uses: Ubuntu/WSL/.github/actions/wsl-bash@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 with: distro: Ubuntu-24.04 working-dir: /tmp/github/ From fcbcc725ce6873ad7cdf759aec13546cc2406be0 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Mon, 6 Jul 2026 10:00:21 +0000 Subject: [PATCH 3/3] ci: pin Ubuntu/WSL actions to main commit SHA (tag lacks action files) Co-Authored-By: Yudai SUZUKI --- .github/workflows/wsl.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/wsl.yml b/.github/workflows/wsl.yml index fe8e22b8b65af5..54087f221f2af6 100644 --- a/.github/workflows/wsl.yml +++ b/.github/workflows/wsl.yml @@ -33,12 +33,12 @@ jobs: uses: Cyberboss/install-winget@1c6f189175e9f015bf1aa113cd1cc6c73efb9d47 # v1.1.1 - name: Install or update WSL - uses: Ubuntu/WSL/.github/actions/wsl-install@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 + uses: Ubuntu/WSL/.github/actions/wsl-install@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main with: distro: Ubuntu-24.04 - name: Install dependencies - uses: Ubuntu/WSL/.github/actions/wsl-bash@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 + uses: Ubuntu/WSL/.github/actions/wsl-bash@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main with: distro: Ubuntu-24.04 working-dir: /tmp/github/ @@ -47,14 +47,14 @@ jobs: DEBIAN_FRONTEND=noninteractive sudo apt install -y ruby build-essential autoconf libssl-dev libyaml-dev zlib1g-dev libgmp-dev libffi-dev - name: Check out the repository - uses: Ubuntu/WSL/.github/actions/wsl-checkout@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 + uses: Ubuntu/WSL/.github/actions/wsl-checkout@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main with: distro: Ubuntu-24.04 working-dir: /tmp/github/ submodules: true - name: Build - uses: Ubuntu/WSL/.github/actions/wsl-bash@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 + uses: Ubuntu/WSL/.github/actions/wsl-bash@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main with: distro: Ubuntu-24.04 working-dir: /tmp/github/ @@ -66,7 +66,7 @@ jobs: make -j4 - name: Test - uses: Ubuntu/WSL/.github/actions/wsl-bash@b92552fbda202b184a10752d3c065dc60d1848db # Ubuntu22.04LTS/2204.1.22 + uses: Ubuntu/WSL/.github/actions/wsl-bash@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main with: distro: Ubuntu-24.04 working-dir: /tmp/github/