ci: pin GitHub action versions

.github/actions/run-fixture-tests/action.yml

@@ -63,7 +63,7 @@ runs:
 
     - name: Restore test fixtures cache
       id: cache-fixtures
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@v5.1.0
       with:
         path: leanSpec/fixtures
         key: leanspec-fixtures-${{ steps.fixtures-release.outputs.sha }}
@@ -98,7 +98,7 @@ runs:
         always()
         && steps.cache-fixtures.outputs.cache-hit != 'true'
         && steps.download-fixtures.outcome == 'success'
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@v5.1.0
       with:
         path: leanSpec/fixtures
         key: ${{ steps.cache-fixtures.outputs.cache-primary-key }}
@@ -117,7 +117,7 @@ runs:
     # Keyed by target so the two halves do not evict each other: the default
     # key covers the job id, which is one value for every leg of a matrix.
     - name: Setup cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@v2.9.3
       with:
         key: ${{ inputs.make-target }}
 

.github/workflows/actions.lock

@@ -0,0 +1,137 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ai-review.yml': []
+    '.github/workflows/ci.yml':
+        - 'actions/cache@v5.1.0'
+        - 'actions/checkout@v6.1.0'
+        - 'dtolnay/rust-toolchain@master'
+        - 'swatinem/rust-cache@v2.9.3'
+    '.github/workflows/daily_ci.yml':
+        - 'actions/cache@v5.1.0'
+        - 'actions/checkout@v6.1.0'
+        - 'dtolnay/rust-toolchain@master'
+        - 'swatinem/rust-cache@v2.9.3'
+    '.github/workflows/daily_loc_report.yml':
+        - 'actions/cache@v5.1.0'
+        - 'actions/checkout@v6.1.0'
+        - 'dtolnay/rust-toolchain@master'
+        - 'swatinem/rust-cache@v2.9.3'
+    '.github/workflows/docker_publish.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'docker/build-push-action@v6.19.2'
+        - 'docker/login-action@v3.7.0'
+        - 'docker/setup-buildx-action@v3.12.0'
+    '.github/workflows/era_replay.yml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/upload-artifact@v4.6.2'
+    '.github/workflows/kurtosis_assertoor.yml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/upload-artifact@v7.0.2'
+    '.github/workflows/pr-main_mdbook.yml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'dtolnay/rust-toolchain@master'
+        - 'lycheeverse/lychee-action@v2.9.0'
+        - 'peaceiris/actions-gh-pages@v4.1.0'
+        - 'peaceiris/actions-mdbook@v2.0.0'
+        - 'swatinem/rust-cache@v2.9.3'
+    '.github/workflows/pr_lint_gha.yaml':
+        - 'actions/checkout@v6.1.0'
+    '.github/workflows/pr_lint_license.yaml':
+        - 'actions/checkout@v6.1.0'
+    '.github/workflows/release.yaml':
+        - 'actions/attest@v4.2.2'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'docker/build-push-action@v6.19.2'
+        - 'docker/login-action@v3.7.0'
+        - 'docker/setup-buildx-action@v3.12.0'
+        - 'dtolnay/rust-toolchain@master'
+        - 'requarks/changelog-action@v1.10.3'
+    '.github/workflows/release_promote.yaml':
+        - 'actions/attest@v4.2.2'
+        - 'docker/login-action@v3.7.0'
+        - 'docker/setup-buildx-action@v3.12.0'
+    '.github/workflows/verify-lockfile.yml':
+        - 'actions/checkout@v6.1.0'
+dependencies:
+    'actions/attest@v4.2.2':
+        ref: 'v4.2.2'
+        commit: 'sha1-1e69f48acb82d1966a394da916b4c1698aa569d6'
+        owner_id: 44036562
+        repo_id: 760701061
+    'actions/cache@v5.1.0':
+        ref: 'v5.1.0'
+        commit: 'sha1-caa296126883cff596d87d8935842f9db880ef25'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'docker/build-push-action@v6.19.2':
+        ref: 'v6.19.2'
+        commit: 'sha1-10e90e3645eae34f1e60eeb005ba3a3d33f178e8'
+        owner_id: 5429470
+        repo_id: 241092383
+    'docker/login-action@v3.7.0':
+        ref: 'v3.7.0'
+        commit: 'sha1-c94ce9fb468520275223c153574b00df6fe4bcc9'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/setup-buildx-action@v3.12.0':
+        ref: 'v3.12.0'
+        commit: 'sha1-8d2750c68a42422c14e847fe6c8ac0403b4cbd6f'
+        owner_id: 5429470
+        repo_id: 288485773
+    'dtolnay/rust-toolchain@master':
+        ref: 'master'
+        commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+        owner_id: 1940490
+        repo_id: 260749683
+    'lycheeverse/lychee-action@v2.9.0':
+        ref: 'v2.9.0'
+        commit: 'sha1-e7477775783ea5526144ba13e8db5eec57747ce8'
+        owner_id: 74027027
+        repo_id: 320929718
+    'peaceiris/actions-gh-pages@v4.1.0':
+        ref: 'v4.1.0'
+        commit: 'sha1-84c30a85c19949d7eee79c4ff27748b70285e453'
+        owner_id: 30958501
+        repo_id: 187915200
+    'peaceiris/actions-mdbook@v2.0.0':
+        ref: 'v2.0.0'
+        commit: 'sha1-ee69d230fe19748b7abf22df32acaa93833fad08'
+        owner_id: 30958501
+        repo_id: 224423059
+    'requarks/changelog-action@v1.10.3':
+        ref: 'v1.10.3'
+        commit: 'sha1-b78a3354a01f4a1affb484b9264b506a815c46b1'
+        owner_id: 16729233
+        repo_id: 450329078
+    'swatinem/rust-cache@v2.9.3':
+        ref: 'v2.9.3'
+        commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
+        owner_id: 580492
+        repo_id: 298565987

.github/workflows/ai-review.yml

@@ -22,18 +22,18 @@ on:
 jobs:
   kimi-review:
     if: github.event_name == 'issue_comment' || github.event.pull_request.draft == false
-    uses: lambdaclass/actions/.github/workflows/ai-review-kimi.yml@v1
+    uses: lambdaclass/actions/.github/workflows/ai-review-kimi.yml@212745563f1482299f563a3eb97909953df2a201 # v1
     secrets:
       KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
 
   codex-review:
     if: github.event_name == 'issue_comment' || github.event.pull_request.draft == false
-    uses: lambdaclass/actions/.github/workflows/ai-review-codex.yml@v1
+    uses: lambdaclass/actions/.github/workflows/ai-review-codex.yml@212745563f1482299f563a3eb97909953df2a201 # v1
     secrets:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
   claude-review:
     if: github.event_name == 'issue_comment' || github.event.pull_request.draft == false
-    uses: lambdaclass/actions/.github/workflows/ai-review-claude.yml@v1
+    uses: lambdaclass/actions/.github/workflows/ai-review-claude.yml@212745563f1482299f563a3eb97909953df2a201 # v1
     secrets:
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

.github/workflows/ci.yml

@@ -36,9 +36,9 @@ jobs:
     name: Lint
     runs-on: ${{ vars.ETHLAMBDA_RUNNER || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -47,7 +47,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
 
       - name: Check formatting
         run: cargo fmt --all -- --check
@@ -90,9 +90,9 @@ jobs:
     name: Test minimal preset
     runs-on: ${{ vars.ETHLAMBDA_RUNNER || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -104,7 +104,7 @@ jobs:
       # builds share almost no artifacts with `lint`'s, so on one key each run
       # would evict the other's.
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
 
       - name: Check the beacon spec-test suite compiles
         run: |
@@ -127,7 +127,7 @@ jobs:
     name: Tooling
     runs-on: ${{ vars.ETHLAMBDA_RUNNER || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -136,7 +136,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
         with:
           workspaces: tooling/event-monitor
 
@@ -162,12 +162,12 @@ jobs:
       matrix:
         half: [consensus, node]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Run fixture-based tests
-        uses: ./.github/actions/run-fixture-tests
+        uses: $/.github/actions/run-fixture-tests
         with:
           make-target: test-${{ matrix.half }}
 
@@ -185,17 +185,17 @@ jobs:
     name: Benchmark smoke
     runs-on: ${{ vars.ETHLAMBDA_RUNNER || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
         with:
           toolchain: "1.97.1"
 
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
 
       - name: Benchmark smoke (mock crypto)
         run: |
@@ -212,7 +212,7 @@ jobs:
     name: Dependency cooldown
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Check lockfiles against the publish-age cooldown
         run: |
@@ -263,9 +263,9 @@ jobs:
       # vectors are a separate download (`make cryptography-specs`) below.
       CONSENSUS_SPEC_TESTS_CONFIGS: ${{ matrix.preset }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -276,7 +276,7 @@ jobs:
       # which are const-generic arguments, so the two legs share no artifacts at
       # all; on one key they would evict each other on every single run.
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
         with:
           key: beacon-${{ matrix.preset }}
 

.github/workflows/daily_ci.yml

@@ -41,10 +41,10 @@ jobs:
       matrix:
         half: [consensus, node]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Run fixture-based tests
-        uses: ./.github/actions/run-fixture-tests
+        uses: $/.github/actions/run-fixture-tests
         with:
           make-target: test-${{ matrix.half }}
 
@@ -57,7 +57,7 @@ jobs:
     if: always()
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Build Slack payload
         # Context values are passed through the environment (never interpolated

.github/workflows/daily_loc_report.yml

@@ -34,22 +34,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
         with:
           toolchain: "1.97.1"
 
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
 
       - name: Install cargo-warloc
         run: cargo install cargo-warloc --locked --version 0.1.1
 
       - name: Restore previous LoC report
         id: cache-loc-report
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v5.1.0
         with:
           path: loc_report.json
           key: loc-report-${{ github.ref_name }}-${{ github.run_id }}
@@ -65,7 +65,7 @@ jobs:
 
       - name: Save new LoC report to cache
         if: success()
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v5.1.0
         with:
           path: loc_report.json
           key: loc-report-${{ github.ref_name }}-${{ github.run_id }}