From 85bd7c0a27a82d47b5a81d52b7b121a31bd16a6c Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 19 Sep 2026 22:54:54 +0000
Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows
could not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`.

`dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an
explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel.

No behaviour is intended to change beyond the pins.
---
 .github/workflows/security.yml |  6 +++---
 .github/workflows/verify.yml   | 14 +++++++-------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index a1b145d..75b8601 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -30,13 +30,13 @@ jobs:
       matrix:
         language: [actions, python]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@v4.36.2
+      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: none
-      - uses: github/codeql-action/analyze@v4.36.2
+      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index f18be88..470eda3 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -32,11 +32,11 @@ jobs:
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git ripgrep python3 \
             agda-bin=2.6.4.3-1+b2 elixir=1.18.3.dfsg-1
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
       - name: Checkout merged epistemic foundations
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           repository: hyperpolymath/epistemic-types
           ref: ad14e35e6e437b116284a43ecff5ebc09d67e37e
@@ -56,7 +56,7 @@ jobs:
           git -c safe.directory="$GITHUB_WORKSPACE" -C "$GITHUB_WORKSPACE" diff --exit-code -- proofs/agda/Firmboot/ElixirAgreement.agda
       - name: Retain exact verification diagnostics
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: agda-elixir-verification
           path: .ci-results
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
       - name: Install proof audit dependency
@@ -95,7 +95,7 @@ jobs:
           bash proofs/lean/verify.sh | tee .ci-results/lean/verify.log
       - name: Retain the complete Lean proof audit log
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: lean-verification
           path: .ci-results/lean
@@ -108,7 +108,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
       - name: Install the authoritative lockfile verifier
@@ -128,7 +128,7 @@ jobs:
         run: |
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git reuse=5.0.2-1
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
       - name: Validate complete licence and copyright coverage