From 445af03386273f0238b66d61e7251b3f06ea70f4 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 11:21:20 +0200 Subject: [PATCH 01/17] ci: pin setup-gradle --- .github/actions/sonatype/release/action.yml | 2 +- .github/workflows/benchmark-jvm.yml | 2 +- .github/workflows/docs-jvm.yml | 2 +- .github/workflows/interop.yml | 2 +- .github/workflows/kotlin-check.yml | 2 +- .github/workflows/package-android.yml | 2 +- .github/workflows/prepare-publish-android.yml | 2 +- .github/workflows/prepare-publish-jvm.yml | 2 +- .github/workflows/prepare-publish-kmp.yml | 2 +- .github/workflows/test-android.yml | 2 +- .github/workflows/test-jvm.yml | 2 +- .github/workflows/test-kmp.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/actions/sonatype/release/action.yml b/.github/actions/sonatype/release/action.yml index ebc2ae97fb..4f23716dd2 100644 --- a/.github/actions/sonatype/release/action.yml +++ b/.github/actions/sonatype/release/action.yml @@ -28,7 +28,7 @@ runs: distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic diff --git a/.github/workflows/benchmark-jvm.yml b/.github/workflows/benchmark-jvm.yml index 9abff183c1..65e20ea202 100644 --- a/.github/workflows/benchmark-jvm.yml +++ b/.github/workflows/benchmark-jvm.yml @@ -80,7 +80,7 @@ jobs: java-version: 25 distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - name: validate gradle wrapper diff --git a/.github/workflows/docs-jvm.yml b/.github/workflows/docs-jvm.yml index 19e191b52a..32bd1c551f 100644 --- a/.github/workflows/docs-jvm.yml +++ b/.github/workflows/docs-jvm.yml @@ -20,7 +20,7 @@ jobs: java-version: 25 distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - name: validate gradle wrapper diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index f7ffe8e716..5943cadbab 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -21,7 +21,7 @@ jobs: java-version: 25 distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - name: validate gradle wrapper diff --git a/.github/workflows/kotlin-check.yml b/.github/workflows/kotlin-check.yml index 6276ec8d84..fc75d80fb2 100644 --- a/.github/workflows/kotlin-check.yml +++ b/.github/workflows/kotlin-check.yml @@ -25,7 +25,7 @@ jobs: chmod a+x ktlint echo "$PWD" >> $GITHUB_PATH - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - name: validate gradle wrapper diff --git a/.github/workflows/package-android.yml b/.github/workflows/package-android.yml index 3d87b7f53b..6b46e5daa4 100644 --- a/.github/workflows/package-android.yml +++ b/.github/workflows/package-android.yml @@ -19,7 +19,7 @@ jobs: java-version: 25 distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - name: validate gradle wrapper diff --git a/.github/workflows/prepare-publish-android.yml b/.github/workflows/prepare-publish-android.yml index 36494bb292..5084d211bb 100644 --- a/.github/workflows/prepare-publish-android.yml +++ b/.github/workflows/prepare-publish-android.yml @@ -39,7 +39,7 @@ jobs: distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic diff --git a/.github/workflows/prepare-publish-jvm.yml b/.github/workflows/prepare-publish-jvm.yml index 70351943d6..65f55d737a 100644 --- a/.github/workflows/prepare-publish-jvm.yml +++ b/.github/workflows/prepare-publish-jvm.yml @@ -39,7 +39,7 @@ jobs: distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic diff --git a/.github/workflows/prepare-publish-kmp.yml b/.github/workflows/prepare-publish-kmp.yml index 68d0526a35..09a63212a6 100644 --- a/.github/workflows/prepare-publish-kmp.yml +++ b/.github/workflows/prepare-publish-kmp.yml @@ -39,7 +39,7 @@ jobs: distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic diff --git a/.github/workflows/test-android.yml b/.github/workflows/test-android.yml index a42069aa9a..f8b939a51a 100644 --- a/.github/workflows/test-android.yml +++ b/.github/workflows/test-android.yml @@ -21,7 +21,7 @@ jobs: java-version: 25 distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - name: validate gradle wrapper diff --git a/.github/workflows/test-jvm.yml b/.github/workflows/test-jvm.yml index 33077620dc..6bc7e23d07 100644 --- a/.github/workflows/test-jvm.yml +++ b/.github/workflows/test-jvm.yml @@ -21,7 +21,7 @@ jobs: java-version: 25 distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - name: validate gradle wrapper diff --git a/.github/workflows/test-kmp.yml b/.github/workflows/test-kmp.yml index bb7302d550..3da6246dd0 100644 --- a/.github/workflows/test-kmp.yml +++ b/.github/workflows/test-kmp.yml @@ -24,7 +24,7 @@ jobs: java-version: 25 distribution: adopt - name: gradle setup - uses: gradle/actions/setup-gradle@v6.2.0 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - name: validate gradle wrapper From f49680e50f7e4756b13f5de9e1e7ef5fe23fee24 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 11:31:39 +0200 Subject: [PATCH 02/17] ci: remove wrapper-validation https://github.com/gradle/actions/blob/main/docs/wrapper-validation.md These docs explain that it isn't needed since setup-gradle v4 --- .github/actions/sonatype/release/action.yml | 3 --- .github/workflows/benchmark-jvm.yml | 2 -- .github/workflows/docs-jvm.yml | 2 -- .github/workflows/interop.yml | 2 -- .github/workflows/kotlin-check.yml | 2 -- .github/workflows/package-android.yml | 3 +-- .github/workflows/prepare-publish-android.yml | 3 --- .github/workflows/prepare-publish-jvm.yml | 3 --- .github/workflows/prepare-publish-kmp.yml | 3 --- .github/workflows/test-android.yml | 3 +-- .github/workflows/test-jvm.yml | 2 -- .github/workflows/test-kmp.yml | 2 -- 12 files changed, 2 insertions(+), 28 deletions(-) diff --git a/.github/actions/sonatype/release/action.yml b/.github/actions/sonatype/release/action.yml index 4f23716dd2..25e96a577f 100644 --- a/.github/actions/sonatype/release/action.yml +++ b/.github/actions/sonatype/release/action.yml @@ -32,9 +32,6 @@ runs: with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - - name: release artifact shell: bash working-directory: crypto-ffi/bindings diff --git a/.github/workflows/benchmark-jvm.yml b/.github/workflows/benchmark-jvm.yml index 65e20ea202..ac0ec2476f 100644 --- a/.github/workflows/benchmark-jvm.yml +++ b/.github/workflows/benchmark-jvm.yml @@ -83,8 +83,6 @@ jobs: uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - name: download linux library uses: ./.github/actions/make diff --git a/.github/workflows/docs-jvm.yml b/.github/workflows/docs-jvm.yml index 32bd1c551f..69b8578dca 100644 --- a/.github/workflows/docs-jvm.yml +++ b/.github/workflows/docs-jvm.yml @@ -23,8 +23,6 @@ jobs: uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - name: download linux library uses: ./.github/actions/make/jvm diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index 5943cadbab..79a740c413 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -24,8 +24,6 @@ jobs: uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - name: setup android sdk uses: android-actions/setup-android@v4 diff --git a/.github/workflows/kotlin-check.yml b/.github/workflows/kotlin-check.yml index fc75d80fb2..f39803696c 100644 --- a/.github/workflows/kotlin-check.yml +++ b/.github/workflows/kotlin-check.yml @@ -28,8 +28,6 @@ jobs: uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - name: download linux library uses: ./.github/actions/make/jvm diff --git a/.github/workflows/package-android.yml b/.github/workflows/package-android.yml index 6b46e5daa4..23e49ef2ba 100644 --- a/.github/workflows/package-android.yml +++ b/.github/workflows/package-android.yml @@ -22,8 +22,7 @@ jobs: uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 + - name: setup android sdk uses: android-actions/setup-android@v4 - name: install ndk and set up environment diff --git a/.github/workflows/prepare-publish-android.yml b/.github/workflows/prepare-publish-android.yml index 5084d211bb..6ae26df994 100644 --- a/.github/workflows/prepare-publish-android.yml +++ b/.github/workflows/prepare-publish-android.yml @@ -43,9 +43,6 @@ jobs: with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - - name: setup android sdk uses: android-actions/setup-android@v4 diff --git a/.github/workflows/prepare-publish-jvm.yml b/.github/workflows/prepare-publish-jvm.yml index 65f55d737a..02a7686aa6 100644 --- a/.github/workflows/prepare-publish-jvm.yml +++ b/.github/workflows/prepare-publish-jvm.yml @@ -43,9 +43,6 @@ jobs: with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - - name: download jvm bindings uses: ./.github/actions/make/bindings-kotlin-jvm with: diff --git a/.github/workflows/prepare-publish-kmp.yml b/.github/workflows/prepare-publish-kmp.yml index 09a63212a6..ef7e663ca7 100644 --- a/.github/workflows/prepare-publish-kmp.yml +++ b/.github/workflows/prepare-publish-kmp.yml @@ -43,9 +43,6 @@ jobs: with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - - name: download ffi library uses: ./.github/actions/make/ffi-library with: diff --git a/.github/workflows/test-android.yml b/.github/workflows/test-android.yml index f8b939a51a..6750ceb3cd 100644 --- a/.github/workflows/test-android.yml +++ b/.github/workflows/test-android.yml @@ -24,8 +24,7 @@ jobs: uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 + - name: enable kvm group perms run: | echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules diff --git a/.github/workflows/test-jvm.yml b/.github/workflows/test-jvm.yml index 6bc7e23d07..62f308045c 100644 --- a/.github/workflows/test-jvm.yml +++ b/.github/workflows/test-jvm.yml @@ -24,8 +24,6 @@ jobs: uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - name: download linux library uses: ./.github/actions/make/jvm diff --git a/.github/workflows/test-kmp.yml b/.github/workflows/test-kmp.yml index 3da6246dd0..d28ae1ef14 100644 --- a/.github/workflows/test-kmp.yml +++ b/.github/workflows/test-kmp.yml @@ -27,8 +27,6 @@ jobs: uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: cache-provider: basic - - name: validate gradle wrapper - uses: gradle/actions/wrapper-validation@v6.2.0 - name: download ffi library uses: ./.github/actions/make/ffi-library From c3672f0207bbeb227461d45a990835eed746dd68 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 11:47:57 +0200 Subject: [PATCH 03/17] ci: reuse setup-and-cache --- .github/workflows/test-e2ei.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/test-e2ei.yml b/.github/workflows/test-e2ei.yml index be7f3f152d..01cbdd8d92 100644 --- a/.github/workflows/test-e2ei.yml +++ b/.github/workflows/test-e2ei.yml @@ -28,9 +28,8 @@ jobs: - keycloak steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions-rust-lang/setup-rust-toolchain@v1.17.0 + - uses: ./.github/actions/setup-and-cache-rust with: rustflags: '' - toolchain: 'stable' - uses: taiki-e/install-action@nextest - run: TEST_IDP=${{ matrix.idp }} sh scripts/run-e2ei-tests.sh From 620e0a3e4d80d64dec5befedaee1530f88a677ad Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 11:48:14 +0200 Subject: [PATCH 04/17] ci: pin setup-rust-toolchain --- .github/actions/setup-and-cache-rust/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/setup-and-cache-rust/action.yml b/.github/actions/setup-and-cache-rust/action.yml index b23f66cee4..604df3d718 100644 --- a/.github/actions/setup-and-cache-rust/action.yml +++ b/.github/actions/setup-and-cache-rust/action.yml @@ -32,7 +32,7 @@ runs: run: | perl -0777 -pi -e 's/^targets = \[.*?\]//ms' rust-toolchain.toml - name: - uses: actions-rust-lang/setup-rust-toolchain@v1.17.0 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: toolchain: ${{ inputs.toolchain }} target: ${{ inputs.target }} From 281c03d6010f492947ccd23705088348677a6674 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:06:18 +0200 Subject: [PATCH 05/17] ci: pin setup-java We did this in a dependabot PR already for workflows. Seems like dependabot misses this file on updates. --- .github/actions/sonatype/release/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/sonatype/release/action.yml b/.github/actions/sonatype/release/action.yml index 25e96a577f..06aef6219b 100644 --- a/.github/actions/sonatype/release/action.yml +++ b/.github/actions/sonatype/release/action.yml @@ -22,7 +22,7 @@ runs: using: composite steps: - name: set up jdk 25 - uses: actions/setup-java@v5.4.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 25 distribution: adopt From 88f144b5d0d8b621f45307a2420f45eebf64833a Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:24:39 +0200 Subject: [PATCH 06/17] ci: pin run-and-post-run --- .github/actions/setup-and-cache-rust/action.yml | 2 +- .github/workflows/test-ios.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/actions/setup-and-cache-rust/action.yml b/.github/actions/setup-and-cache-rust/action.yml index 604df3d718..af19271c15 100644 --- a/.github/actions/setup-and-cache-rust/action.yml +++ b/.github/actions/setup-and-cache-rust/action.yml @@ -45,7 +45,7 @@ runs: run: | ./scripts/uninstall_inactive_rust_toolchains.sh - name: Cleanup on post - uses: gacts/run-and-post-run@v1 + uses: gacts/run-and-post-run@598d7a875d5620e0457490555b5e18e46082aa47 # v1.4.4 with: post: | sh ./scripts/clean.sh diff --git a/.github/workflows/test-ios.yml b/.github/workflows/test-ios.yml index 8dd8a609a1..254d3f2102 100644 --- a/.github/workflows/test-ios.yml +++ b/.github/workflows/test-ios.yml @@ -19,7 +19,7 @@ jobs: runs-on: self-hosted steps: - name: Cleanup on post - uses: gacts/run-and-post-run@v1 + uses: gacts/run-and-post-run@598d7a875d5620e0457490555b5e18e46082aa47 # v1.4.4 with: post: | sh ./scripts/clean.sh From 2932b92162db7da7ccf5389ec3529eb35152898e Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:26:19 +0200 Subject: [PATCH 07/17] ci: pin cache action --- .github/actions/setup-and-cache-rust/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/setup-and-cache-rust/action.yml b/.github/actions/setup-and-cache-rust/action.yml index af19271c15..e900623fc3 100644 --- a/.github/actions/setup-and-cache-rust/action.yml +++ b/.github/actions/setup-and-cache-rust/action.yml @@ -50,7 +50,7 @@ runs: post: | sh ./scripts/clean.sh - name: Cache build artifacts - uses: actions/cache@v6.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cargo/registry/index/ From 8c07f0a7f6677b84fa07c53366ddb8c79d4ac4b9 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:28:53 +0200 Subject: [PATCH 08/17] ci: pin install-action --- .github/actions/build-cc-book/action.yml | 2 +- .github/actions/make/action.yml | 2 +- .github/actions/setup-wasm-bindgen/action.yml | 2 +- .github/workflows/deny.yml | 2 +- .github/workflows/markdown.yml | 2 +- .github/workflows/toml.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/actions/build-cc-book/action.yml b/.github/actions/build-cc-book/action.yml index a5d1f31e18..c16919ef95 100644 --- a/.github/actions/build-cc-book/action.yml +++ b/.github/actions/build-cc-book/action.yml @@ -6,7 +6,7 @@ runs: steps: - name: Install mdBook tools - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: | mdbook diff --git a/.github/actions/make/action.yml b/.github/actions/make/action.yml index 49d9d1daf0..5937c4a09b 100644 --- a/.github/actions/make/action.yml +++ b/.github/actions/make/action.yml @@ -35,7 +35,7 @@ runs: using: composite steps: - name: setup fd - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: fd-find - name: Set MAKE diff --git a/.github/actions/setup-wasm-bindgen/action.yml b/.github/actions/setup-wasm-bindgen/action.yml index efe9080b0f..6a2440d767 100644 --- a/.github/actions/setup-wasm-bindgen/action.yml +++ b/.github/actions/setup-wasm-bindgen/action.yml @@ -14,6 +14,6 @@ runs: echo "wasm_bindgen_version=$version" >> "$GITHUB_OUTPUT" - name: Install wasm-bindgen-cli - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: wasm-bindgen-cli@${{ steps.cargo_metadata.outputs.wasm_bindgen_version }} diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml index b390f58c75..1a80fe1ff6 100644 --- a/.github/workflows/deny.yml +++ b/.github/workflows/deny.yml @@ -23,7 +23,7 @@ jobs: - uses: ./.github/actions/setup-and-cache-rust with: rustflags: '' - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: cargo-deny@0.19 - name: "check licenses / supply chain" diff --git a/.github/workflows/markdown.yml b/.github/workflows/markdown.yml index 3179af4053..269540edf9 100644 --- a/.github/workflows/markdown.yml +++ b/.github/workflows/markdown.yml @@ -12,7 +12,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: setup fd - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: fd-find - name: install mdformat diff --git a/.github/workflows/toml.yml b/.github/workflows/toml.yml index 3a5b990d52..c8101eafb6 100644 --- a/.github/workflows/toml.yml +++ b/.github/workflows/toml.yml @@ -13,7 +13,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: uncenter/setup-taplo@v2 - name: setup fd - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: fd-find - run: fd --glob --hidden '*.toml' -X taplo fmt --check From a6bd82a2a88e638be32e2396b72baca400cd7d5a Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:32:04 +0200 Subject: [PATCH 09/17] ci: pin upload-artifact --- .github/actions/make/action.yml | 2 +- .github/workflows/benchmark-jvm.yml | 2 +- .github/workflows/benchmark-ts-browser.yml | 2 +- .github/workflows/benchmark-ts-native.yml | 2 +- .github/workflows/docs-cc-book.yml | 2 +- .github/workflows/docs-jvm.yml | 2 +- .github/workflows/docs-swift.yml | 2 +- .github/workflows/docs-ts.yml | 2 +- .github/workflows/pipeline.yml | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/actions/make/action.yml b/.github/actions/make/action.yml index 5937c4a09b..e085a9fce6 100644 --- a/.github/actions/make/action.yml +++ b/.github/actions/make/action.yml @@ -147,7 +147,7 @@ runs: - name: Upload artifact if it doesn't exist for this workflow run if: steps.download.outputs.found_in_this_run != 'true' - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ steps.compute-key.outputs.key }} path: artifact.tar.gz diff --git a/.github/workflows/benchmark-jvm.yml b/.github/workflows/benchmark-jvm.yml index ac0ec2476f..5995c0f67e 100644 --- a/.github/workflows/benchmark-jvm.yml +++ b/.github/workflows/benchmark-jvm.yml @@ -114,7 +114,7 @@ jobs: run: make jvm-bench - name: Upload benchmark result - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: benchmark-jvm-results path: crypto-ffi/bindings/jvm/build/reports/jmh/results.json diff --git a/.github/workflows/benchmark-ts-browser.yml b/.github/workflows/benchmark-ts-browser.yml index e19685d9a4..ef107e20f2 100644 --- a/.github/workflows/benchmark-ts-browser.yml +++ b/.github/workflows/benchmark-ts-browser.yml @@ -106,7 +106,7 @@ jobs: run: jq -s add crypto-ffi/bindings/js/benches_result/*.json > benches_result.json - name: Upload benchmark result - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: benchmark-ts-browser-results path: benches_result.json diff --git a/.github/workflows/benchmark-ts-native.yml b/.github/workflows/benchmark-ts-native.yml index 06c0b8a74a..9072b0b572 100644 --- a/.github/workflows/benchmark-ts-native.yml +++ b/.github/workflows/benchmark-ts-native.yml @@ -94,7 +94,7 @@ jobs: run: jq -s add crypto-ffi/bindings/js/benches_result/*.json > benches_result.json - name: Upload benchmark result - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: benchmark-ts-native-results path: benches_result.json diff --git a/.github/workflows/docs-cc-book.yml b/.github/workflows/docs-cc-book.yml index 2b30949d18..7bc810d34a 100644 --- a/.github/workflows/docs-cc-book.yml +++ b/.github/workflows/docs-cc-book.yml @@ -14,7 +14,7 @@ jobs: - uses: ./.github/actions/build-cc-book - - uses: actions/upload-artifact@v7.0.1 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: cc-book path: cc-book/book diff --git a/.github/workflows/docs-jvm.yml b/.github/workflows/docs-jvm.yml index 69b8578dca..0ff2f8f611 100644 --- a/.github/workflows/docs-jvm.yml +++ b/.github/workflows/docs-jvm.yml @@ -46,7 +46,7 @@ jobs: artifact-generation: ${{ vars.ARTIFACT_GENERATION }} - name: upload kotlin docs - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: kotlin path: target/kotlin/doc/html diff --git a/.github/workflows/docs-swift.yml b/.github/workflows/docs-swift.yml index 8953c29e7e..78efa55e74 100644 --- a/.github/workflows/docs-swift.yml +++ b/.github/workflows/docs-swift.yml @@ -63,7 +63,7 @@ jobs: --build-tool-arguments -project,WireCoreCrypto.xcodeproj,-scheme,WireCoreCrypto,-configuration,Release \ -o ../../../../target/swift/doc - - uses: actions/upload-artifact@v7.0.1 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: swift path: target/swift/doc diff --git a/.github/workflows/docs-ts.yml b/.github/workflows/docs-ts.yml index 205e6e7acd..9679d79538 100644 --- a/.github/workflows/docs-ts.yml +++ b/.github/workflows/docs-ts.yml @@ -36,7 +36,7 @@ jobs: - name: make ts docs run: make docs-ts - - uses: actions/upload-artifact@v7.0.1 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: typescript path: target/typescript/doc diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml index f2af711608..bc35ab4a49 100644 --- a/.github/workflows/pipeline.yml +++ b/.github/workflows/pipeline.yml @@ -299,7 +299,7 @@ jobs: - uses: ./.github/actions/setup-and-cache-rust - run: cargo doc --all --no-deps --locked - - uses: actions/upload-artifact@v7.0.1 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: rust path: target/doc From 4186f720202e133cc0f6ca4e3b03e90080734274 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:33:56 +0200 Subject: [PATCH 10/17] ci: pin download-artifact --- .github/workflows/benchmark-jvm-publish.yml | 2 +- .github/workflows/benchmark-ts-browser-publish.yml | 2 +- .github/workflows/benchmark-ts-native-publish.yml | 2 +- .github/workflows/deploy-docs.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/benchmark-jvm-publish.yml b/.github/workflows/benchmark-jvm-publish.yml index d75bbe62db..59480e1ae0 100644 --- a/.github/workflows/benchmark-jvm-publish.yml +++ b/.github/workflows/benchmark-jvm-publish.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download benchmark result - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: benchmark-jvm-results path: crypto-ffi/bindings/jvm/build/reports/jmh diff --git a/.github/workflows/benchmark-ts-browser-publish.yml b/.github/workflows/benchmark-ts-browser-publish.yml index c21b08ec52..7d60b734eb 100644 --- a/.github/workflows/benchmark-ts-browser-publish.yml +++ b/.github/workflows/benchmark-ts-browser-publish.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download benchmark result - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: benchmark-ts-browser-results diff --git a/.github/workflows/benchmark-ts-native-publish.yml b/.github/workflows/benchmark-ts-native-publish.yml index c297af9db8..ff1cdf2d49 100644 --- a/.github/workflows/benchmark-ts-native-publish.yml +++ b/.github/workflows/benchmark-ts-native-publish.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download benchmark result - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: benchmark-ts-native-results diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml index 6c737b5ca8..b880a00954 100644 --- a/.github/workflows/deploy-docs.yml +++ b/.github/workflows/deploy-docs.yml @@ -21,7 +21,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: download pre-rendered docs - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: '{cc-book,typescript,swift,kotlin,rust}' path: "./target/doc/${{ env.GIT_TAG }}" From 99b09ac12c2aea9889bd788d6e1837c01345254e Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:36:31 +0200 Subject: [PATCH 11/17] ci: pin github-action-benchmark --- .github/workflows/benchmark-jvm-publish.yml | 2 +- .github/workflows/benchmark-ts-browser-publish.yml | 2 +- .github/workflows/benchmark-ts-native-publish.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/benchmark-jvm-publish.yml b/.github/workflows/benchmark-jvm-publish.yml index 59480e1ae0..cc985dcb44 100644 --- a/.github/workflows/benchmark-jvm-publish.yml +++ b/.github/workflows/benchmark-jvm-publish.yml @@ -23,7 +23,7 @@ jobs: path: crypto-ffi/bindings/jvm/build/reports/jmh - name: Publish benchmark result - uses: benchmark-action/github-action-benchmark@v1 + uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1 with: name: "JVM Benchmarks" tool: 'jmh' diff --git a/.github/workflows/benchmark-ts-browser-publish.yml b/.github/workflows/benchmark-ts-browser-publish.yml index 7d60b734eb..c8e32927f4 100644 --- a/.github/workflows/benchmark-ts-browser-publish.yml +++ b/.github/workflows/benchmark-ts-browser-publish.yml @@ -22,7 +22,7 @@ jobs: name: benchmark-ts-browser-results - name: Publish benchmark result - uses: benchmark-action/github-action-benchmark@v1 + uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1 with: name: "Browser Benchmarks" tool: 'customBiggerIsBetter' diff --git a/.github/workflows/benchmark-ts-native-publish.yml b/.github/workflows/benchmark-ts-native-publish.yml index ff1cdf2d49..c9c41d7870 100644 --- a/.github/workflows/benchmark-ts-native-publish.yml +++ b/.github/workflows/benchmark-ts-native-publish.yml @@ -22,7 +22,7 @@ jobs: name: benchmark-ts-native-results - name: Publish benchmark result - uses: benchmark-action/github-action-benchmark@v1 + uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1 with: name: "TS Native Benchmarks" tool: 'customBiggerIsBetter' From 7b47ef8ca8fc23ce5175b0b6ac359f26152c3516 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:38:11 +0200 Subject: [PATCH 12/17] ci: pin setup-bun --- .github/workflows/benchmark-ts-browser.yml | 2 +- .github/workflows/benchmark-ts-native.yml | 2 +- .github/workflows/check-ts.yml | 2 +- .github/workflows/docs-ts.yml | 2 +- .github/workflows/interop.yml | 2 +- .github/workflows/pipeline.yml | 6 +++--- .github/workflows/publish-npm.yml | 2 +- .github/workflows/test-ts-browser.yml | 2 +- .github/workflows/test-ts-native.yml | 2 +- 9 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/benchmark-ts-browser.yml b/.github/workflows/benchmark-ts-browser.yml index ef107e20f2..fd3ecdba60 100644 --- a/.github/workflows/benchmark-ts-browser.yml +++ b/.github/workflows/benchmark-ts-browser.yml @@ -75,7 +75,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest diff --git a/.github/workflows/benchmark-ts-native.yml b/.github/workflows/benchmark-ts-native.yml index 9072b0b572..ecef5416ac 100644 --- a/.github/workflows/benchmark-ts-native.yml +++ b/.github/workflows/benchmark-ts-native.yml @@ -75,7 +75,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest diff --git a/.github/workflows/check-ts.yml b/.github/workflows/check-ts.yml index bb939dd351..6c49ecece7 100644 --- a/.github/workflows/check-ts.yml +++ b/.github/workflows/check-ts.yml @@ -16,7 +16,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest diff --git a/.github/workflows/docs-ts.yml b/.github/workflows/docs-ts.yml index 9679d79538..1402cf9864 100644 --- a/.github/workflows/docs-ts.yml +++ b/.github/workflows/docs-ts.yml @@ -17,7 +17,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index 79a740c413..9dafd2a90a 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -43,7 +43,7 @@ jobs: uses: maxim-lobanov/setup-xcode@v1 with: xcode-version: '26.6.0' - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest - name: Install chrome-headless-shell diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml index bc35ab4a49..141cd39462 100644 --- a/.github/workflows/pipeline.yml +++ b/.github/workflows/pipeline.yml @@ -201,7 +201,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest - name: build ts @@ -214,7 +214,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest - name: build ts @@ -227,7 +227,7 @@ jobs: runs-on: macos-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest - name: build ts diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index d4f659afb4..d85d8e40ed 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -30,7 +30,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest diff --git a/.github/workflows/test-ts-browser.yml b/.github/workflows/test-ts-browser.yml index cab4992fa4..35e3fcece6 100644 --- a/.github/workflows/test-ts-browser.yml +++ b/.github/workflows/test-ts-browser.yml @@ -20,7 +20,7 @@ jobs: id: setup-chrome with: chrome-version: stable - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest diff --git a/.github/workflows/test-ts-native.yml b/.github/workflows/test-ts-native.yml index 3194387900..e21de78c9c 100644 --- a/.github/workflows/test-ts-native.yml +++ b/.github/workflows/test-ts-native.yml @@ -15,7 +15,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest From 04a9ceb876c43e60a9f1789b096e0df43dba6866 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:40:59 +0200 Subject: [PATCH 13/17] ci: pin setup-xcode --- .github/workflows/docs-swift.yml | 2 +- .github/workflows/interop.yml | 2 +- .github/workflows/package-ios.yml | 2 +- .github/workflows/test-ios.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docs-swift.yml b/.github/workflows/docs-swift.yml index 78efa55e74..546b888030 100644 --- a/.github/workflows/docs-swift.yml +++ b/.github/workflows/docs-swift.yml @@ -39,7 +39,7 @@ jobs: artifact-generation: ${{ vars.ARTIFACT_GENERATION }} - name: setup Xcode - uses: maxim-lobanov/setup-xcode@v1 + uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0 with: xcode-version: '26.3.0' - name: Set up Ruby environment diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index 9dafd2a90a..69bed6ac39 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -40,7 +40,7 @@ jobs: echo ANDROID_NDK_ROOT=$ANDROID_NDK_HOME >> $GITHUB_ENV - name: setup Xcode - uses: maxim-lobanov/setup-xcode@v1 + uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0 with: xcode-version: '26.6.0' - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 diff --git a/.github/workflows/package-ios.yml b/.github/workflows/package-ios.yml index fce7ae2b41..cb3d691c9a 100644 --- a/.github/workflows/package-ios.yml +++ b/.github/workflows/package-ios.yml @@ -40,7 +40,7 @@ jobs: artifact-generation: ${{ vars.ARTIFACT_GENERATION }} - name: setup Xcode - uses: maxim-lobanov/setup-xcode@v1 + uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0 with: xcode-version: '26.6.0' diff --git a/.github/workflows/test-ios.yml b/.github/workflows/test-ios.yml index 254d3f2102..0ab51124a7 100644 --- a/.github/workflows/test-ios.yml +++ b/.github/workflows/test-ios.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: setup Xcode - uses: maxim-lobanov/setup-xcode@v1 + uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0 with: xcode-version: '26.6.0' From 0d514dbbfa29366f28b4823029471d03e90e56bc Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:42:46 +0200 Subject: [PATCH 14/17] ci: pin setup-ruby --- .github/workflows/docs-swift.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-swift.yml b/.github/workflows/docs-swift.yml index 546b888030..6ade037350 100644 --- a/.github/workflows/docs-swift.yml +++ b/.github/workflows/docs-swift.yml @@ -43,7 +43,7 @@ jobs: with: xcode-version: '26.3.0' - name: Set up Ruby environment - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: '3.3' From 52d58f55a02c32e1530895924d8fc02dc2e20bcc Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:50:11 +0200 Subject: [PATCH 15/17] ci: pin setup-swift --- .github/workflows/docs-swift.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-swift.yml b/.github/workflows/docs-swift.yml index 6ade037350..77cc913788 100644 --- a/.github/workflows/docs-swift.yml +++ b/.github/workflows/docs-swift.yml @@ -50,7 +50,7 @@ jobs: - name: install jazzy run: gem install jazzy - - uses: swift-actions/setup-swift@v3 + - uses: swift-actions/setup-swift@364295d9c23900ce04d4e5cc708387921b4e50f9 # v3.0.0-beta.1 with: swift-version: "6.0" From 3b8c179e0b9db4a4174a706186e40d870546e14d Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:54:13 +0200 Subject: [PATCH 16/17] ci: pin setup-android --- .github/workflows/build-android.yml | 2 +- .github/workflows/interop.yml | 2 +- .github/workflows/package-android.yml | 2 +- .github/workflows/prepare-publish-android.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml index 8d0424f419..1243bae2f8 100644 --- a/.github/workflows/build-android.yml +++ b/.github/workflows/build-android.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: setup android sdk - uses: android-actions/setup-android@v4 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 with: # Don't download unnecessary packages. # We only need sdkmanager for the next step. diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml index 69bed6ac39..2d08392ebd 100644 --- a/.github/workflows/interop.yml +++ b/.github/workflows/interop.yml @@ -26,7 +26,7 @@ jobs: cache-provider: basic - name: setup android sdk - uses: android-actions/setup-android@v4 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 with: # Don't download unnecessary packages. # We only need sdkmanager for the next step. diff --git a/.github/workflows/package-android.yml b/.github/workflows/package-android.yml index 23e49ef2ba..6db48424dc 100644 --- a/.github/workflows/package-android.yml +++ b/.github/workflows/package-android.yml @@ -24,7 +24,7 @@ jobs: cache-provider: basic - name: setup android sdk - uses: android-actions/setup-android@v4 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 - name: install ndk and set up environment run: | ndk_version=$(cat crypto-ffi/bindings/android/ndk.version) diff --git a/.github/workflows/prepare-publish-android.yml b/.github/workflows/prepare-publish-android.yml index 6ae26df994..e081e9f5e6 100644 --- a/.github/workflows/prepare-publish-android.yml +++ b/.github/workflows/prepare-publish-android.yml @@ -44,7 +44,7 @@ jobs: cache-provider: basic - name: setup android sdk - uses: android-actions/setup-android@v4 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 - name: download android package uses: ./.github/actions/make/android/package From 367efcaa8b227d34db1195c275247dfa23d3de13 Mon Sep 17 00:00:00 2001 From: Felix Werner Date: Tue, 28 Jul 2026 12:56:05 +0200 Subject: [PATCH 17/17] ci: pin setup-taplo --- .github/workflows/toml.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/toml.yml b/.github/workflows/toml.yml index c8101eafb6..a44b17d06b 100644 --- a/.github/workflows/toml.yml +++ b/.github/workflows/toml.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: uncenter/setup-taplo@v2 + - uses: uncenter/setup-taplo@b18c8c8302695fe63d6853bc004006215ac52b91 # v2 - name: setup fd uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: