From 10bc7d8a3d15e79ccbeee85e6f05f886fae9ef3d Mon Sep 17 00:00:00 2001
From: rfxfxfx <milechen333@gmail.com>
Date: Sat, 29 Aug 2026 00:04:39 +0800
Subject: [PATCH] ci: pin remaining GitHub Actions to commit SHAs

`ci.yml` referenced three actions by mutable tag, while
`release-binaries.yaml` already pins the same actions by commit SHA:

  actions-rust-lang/setup-rust-toolchain@v1  (5 uses)
  taiki-e/install-action@v2                  (2 uses)
  foundry-rs/foundry-toolchain@v1            (4 uses)

A moved tag or a compromised upstream action would execute arbitrary code
in CI. Pinning to a SHA makes the supply chain immutable and brings this
workflow in line with the convention already used elsewhere in the repo.

Each pin resolves to the tag that `@v1`/`@v2` currently point at, so CI
behaviour is unchanged:

  setup-rust-toolchain 166cdcfd11aee3cb47222f9ddb555ce30ddb9659  v1.17.0
  install-action       a2a5f6e99e1a31540baa0468acfa302cff0f359f  v2.86.4
  foundry-toolchain    908c540300062bd5a7e473851cdb4282204cee09  v1.9.1

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b655f8fa..0b19ca50 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           components: rustfmt
 
@@ -41,7 +41,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Install cargo-sort
         run: cargo install cargo-sort
@@ -59,7 +59,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libclang-dev zlib1g-dev
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           components: clippy
           cache-shared-key: rust-build
@@ -78,12 +78,12 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libclang-dev zlib1g-dev
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           cache-shared-key: rust-build
 
       - name: Install nextest
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@a2a5f6e99e1a31540baa0468acfa302cff0f359f # v2.86.4
         with:
           tool: nextest
 
@@ -104,7 +104,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libclang-dev zlib1g-dev
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -120,12 +120,12 @@ jobs:
         run: echo "version=$(cat .foundry-version)" >> $GITHUB_OUTPUT
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
         with:
           version: ${{ steps.foundry-version.outputs.version }}
 
       - name: Install nextest
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@a2a5f6e99e1a31540baa0468acfa302cff0f359f # v2.86.4
         with:
           tool: nextest
 
@@ -185,7 +185,7 @@ jobs:
         run: echo "version=$(cat .foundry-version)" >> $GITHUB_OUTPUT
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
         with:
           version: ${{ steps.foundry-version.outputs.version }}
 
@@ -215,7 +215,7 @@ jobs:
         run: echo "version=$(cat .foundry-version)" >> $GITHUB_OUTPUT
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
         with:
           version: ${{ steps.foundry-version.outputs.version }}
 
@@ -237,7 +237,7 @@ jobs:
         run: echo "version=$(cat .foundry-version)" >> $GITHUB_OUTPUT
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
         with:
           version: ${{ steps.foundry-version.outputs.version }}