[seuninfoo-svg]

Close #481

PR: Pin Third-Party GitHub Actions to Immutable Commit SHAs

Summary

Pin every third-party action in .github/workflows/*.yml to a full 40-character commit SHA while preserving a human-readable version comment. This makes workflow dependencies immutable and protects against supply-chain attacks via compromised action releases.

Problem

Workflows currently reference moving tags (e.g., actions/checkout@v4, actions/setup-node@v4). If a tag is moved to a malicious commit, all workflows using that tag would execute untrusted code.

Solution

Replace all uses: entries with pinned commit SHAs with trailing version comments:

• actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
• actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
• pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
• dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
• Swatinem/rust-cache@e9d7b9f1e587218970671bac74e5511ed9506e6a # v2

Files Modified

File	Actions Pinned
.github/workflows/bindings-check.yml	5 actions
.github/workflows/contract.yml	4 actions
.github/workflows/coverage.yml	3 actions
.github/workflows/docs-links.yml	2 actions

Verification

# All pins are 40-char SHAs
grep -oE '@[a-f0-9]{40}' .github/workflows/*.yml | sort -u

# Each has a version comment
grep -E 'uses:.*#' .github/workflows/*.yml

Acceptance Criteria ✅

• Every uses: entry is pinned to a 40-character commit SHA
• Each pin includes a trailing comment with the human-readable release tag
• Existing workflow behavior, permissions, and timeouts remain unchanged
• No local action path is accidentally rewritten (no local actions exist)
• No application code changes needed