ci: aarch64 Linux wheels, protoc without Chocolatey, pinned actions and zizmor

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# Keep the commit-SHA pins on GitHub Actions current. One grouped PR a week, and only for
+# releases at least a week old, so a compromised release has time to be caught first.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/docs.yml

@@ -34,8 +34,10 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
       - name: Build the site
         run: uv run --project docs --locked zensical build --strict

.github/workflows/python-publish.yml

@@ -1,5 +1,5 @@
-# Build, test and publish lance-csr wheels: Linux x86-64 (manylinux_2_28), native
-# Apple Silicon (macOS arm64) and Windows x86-64, plus an sdist for every other platform.
+# Build, test and publish lance-csr wheels: Linux x86-64 and aarch64 (manylinux_2_28),
+# native Apple Silicon (macOS arm64) and Windows x86-64, plus an sdist for every other platform.
 #
 # Pull requests that change how wheels are built (this workflow, the wheel check, the
 # release build profile) build and test them without publishing. A release builds and tests
@@ -45,18 +45,31 @@ env:
 jobs:
   build-linux:
     # Built on the host with zig as the linker, targeting glibc 2.28 (RHEL 8, Ubuntu 20.04
-    # and newer); the same command produced the alpha's tested Linux wheels.
-    runs-on: ubuntu-24.04
+    # and newer); the same command produced the alpha's tested Linux wheels. Each
+    # architecture builds natively on its own runner.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
+        with:
+
+          enable-cache: false
       - name: Install build dependencies
         run: |
           # protoc is needed by Lance's build scripts, not by wheel users.
@@ -67,18 +80,20 @@ jobs:
           uv tool install ziglang
           "$(uv tool dir)/ziglang/bin/python" -c "import os, ziglang; print(os.path.dirname(ziglang.__file__))" >> "$GITHUB_PATH"
 
-      - name: Build manylinux_2_28 x86-64 wheel
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
+      - name: Build manylinux_2_28 ${{ matrix.arch }} wheel
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
         with:
           command: build
           working-directory: python
-          target: x86_64-unknown-linux-gnu
+          target: ${{ matrix.arch }}-unknown-linux-gnu
           container: "off"
-          sccache: "true"
+          # No sccache: release wheels are built without restoring any cache.
+          sccache: "false"
           args: --release --locked --strip --zig --compatibility manylinux_2_28 --out dist
 
       - name: Build sdist
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
+        if: matrix.arch == 'x86_64'
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
         with:
           command: sdist
           working-directory: python
@@ -90,9 +105,9 @@ jobs:
           uvx twine check dist/*
           sha256sum dist/*
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: python-dist-linux
+          name: python-dist-linux-${{ matrix.arch }}
           path: python/dist/*
           if-no-files-found: error
 
@@ -103,24 +118,29 @@ jobs:
     env:
       MACOSX_DEPLOYMENT_TARGET: "11.0"
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+
+        with:
 
+          enable-cache: false
       - name: Install build dependencies
         run: brew install protobuf
 
       - name: Build Apple Silicon wheel
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
         with:
           command: build
           working-directory: python
           target: aarch64-apple-darwin
-          sccache: "true"
+          # No sccache: release wheels are built without restoring any cache.
+          sccache: "false"
           args: --release --locked --strip --out dist
 
       - name: Inspect wheel
@@ -129,7 +149,7 @@ jobs:
           uvx twine check dist/*.whl
           shasum -a 256 dist/*.whl
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: python-dist-macos-arm64
           path: python/dist/*.whl
@@ -139,24 +159,34 @@ jobs:
     runs-on: windows-2022
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
+        with:
+
+          enable-cache: false
       - name: Install build dependencies
-        run: choco install protoc --version=29.3 -y --no-progress
+        # protoc comes from its GitHub release: Chocolatey's feed is intermittently unreachable from runners.
+        run: |
+          $zip = "$env:RUNNER_TEMP\protoc.zip"
+          Invoke-WebRequest https://github.com/protocolbuffers/protobuf/releases/download/v29.3/protoc-29.3-win64.zip -OutFile $zip
+          if ((Get-FileHash $zip -Algorithm SHA256).Hash -ne "57EA59E9F551AD8D71FFAA9B5CFBE0CA1F4E720972A1DB7EC2D12AB44BFF9383") { throw "protoc checksum mismatch" }
+          Expand-Archive $zip "$env:RUNNER_TEMP\protoc"
+          "$env:RUNNER_TEMP\protoc\bin" | Out-File -Append -Encoding utf8 $env:GITHUB_PATH
 
       - name: Build Windows x86-64 wheel
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
         with:
           command: build
           working-directory: python
           target: x86_64-pc-windows-msvc
-          # sccache's Windows server dropped the connection mid-way through compiling lance.
+          # No sccache: release wheels are built without restoring any cache.
           sccache: "false"
           args: --release --locked --strip --out dist
 
@@ -167,7 +197,7 @@ jobs:
           uvx twine check dist/*.whl
           sha256sum dist/*.whl
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: python-dist-windows-x64
           path: python/dist/*.whl
@@ -181,20 +211,24 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04, macos-15, windows-2022]
+        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-15, windows-2022]
         python: ["3.12", "3.13", "3.14"]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          persist-credentials: false
           sparse-checkout: |
             ci
             python/python/tests
 
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
-      - uses: actions/download-artifact@v4
+        with:
+
+          enable-cache: false
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: python-dist-*
           merge-multiple: true
@@ -207,7 +241,7 @@ jobs:
           ! command -v cargo && ! command -v rustc
           # This platform's wheel, by path, so PyPI's copy of the same version can't stand in.
           case "$RUNNER_OS" in
-            Linux) wheel=$(ls "$PWD"/dist/*manylinux*.whl) ;;
+            Linux) wheel=$(ls "$PWD"/dist/*manylinux*_"$(uname -m)".whl) ;;
             macOS) wheel=$(ls "$PWD"/dist/*macosx*.whl) ;;
             Windows) wheel=$(cygpath -w "$(ls "$PWD"/dist/*win_amd64*.whl)") ;;
           esac
@@ -232,25 +266,31 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          persist-credentials: false
           sparse-checkout: python/pyproject.toml
 
       - name: Check the release tag matches the package version
         if: github.event_name == 'release'
+        env:
+          TAG: ${{ github.event.release.tag_name }}
         run: |
           version=$(grep -m1 '^version = ' python/pyproject.toml | cut -d'"' -f2)
-          test "${{ github.event.release.tag_name }}" = "v$version" || {
-            echo "Release tag ${{ github.event.release.tag_name }} does not match version $version"; exit 1; }
+          test "$TAG" = "v$version" || {
+            echo "Release tag $TAG does not match version $version"; exit 1; }
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: python-dist-*
           merge-multiple: true
           path: dist
 
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+
+        with:
 
+          enable-cache: false
       - name: Publish to PyPI
         run: uv publish --trusted-publishing always dist/*
 
@@ -268,8 +308,9 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Install build dependencies
         run: |
           sudo apt-get update
@@ -279,7 +320,7 @@ jobs:
       - name: Package and verify the crate
         run: cargo package --locked -p lance-csr
 
-      - uses: rust-lang/crates-io-auth-action@v1
+      - uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
         id: auth
 
       - name: Publish to crates.io

.github/workflows/python-test.yml

@@ -26,6 +26,9 @@ env:
   RUSTFLAGS: "-C debuginfo=line-tables-only"
   CARGO_INCREMENTAL: "0"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-24.04
@@ -34,13 +37,15 @@ jobs:
       matrix:
         python-version: ["3.12"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           # The rust-cache step below caches the bindings crate.
           cache: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
           shared-key: "lance-csr-python"
@@ -56,7 +61,7 @@ jobs:
           sudo apt update
           sudo apt install -y protobuf-compiler
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
       - name: Install locked dependencies
         working-directory: python
         # The package itself is built by maturin develop below, in debug mode.
@@ -72,9 +77,11 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
       - name: Install locked dependencies
         working-directory: python
         # Linting needs no build of the Rust extension.

.github/workflows/rust-test.yml

@@ -25,14 +25,19 @@ env:
   RUST_BACKTRACE: "1"
   CARGO_INCREMENTAL: "0"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       # rust-toolchain.toml selects the toolchain.
-      - uses: actions/checkout@v4
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: "lance-csr-deps"
           # Pull requests restore main's cache but don't save copies that crowd it out.

.github/workflows/spelling.yml

@@ -10,12 +10,17 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   typos:
     name: Spell Check
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Check spelling
-        uses: crate-ci/typos@v1.26.0
+        uses: crate-ci/typos@6802cc60d4e7f78b9d5454f6cf3935c042d5e1e3 # v1.26.0