chore(ci): pin every workflow action to a commit SHA

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       code_changed: ${{ steps.classify.outputs.code_changed }}
     steps:
       - name: Checkout full history
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
       - name: Classify changed paths (fail closed on unknown/empty diff)
@@ -73,14 +73,32 @@ jobs:
             echo "code_changed=true" >> "$GITHUB_OUTPUT"
           fi
           printf 'Changed files:\n%s\n' "$files"
+      # Every action reference is pinned to a commit SHA. This runs in the
+      # `changes` job — which every push and pull request executes, and
+      # which the `fmt` and `gate` jobs depend on — so an unpinned action
+      # fails the workflow before any job builds or publishes anything.
+      - name: Every action is pinned to a commit SHA
+        run: |
+          python3 scripts/validate_workflow_pins.py .github/workflows
+          bash scripts/validate_workflow_pins-selftest.sh
+      # The release path — the script that stages the artifacts and builds
+      # the `gh release create` call, and the rule that decides whether a
+      # tag is a production release or a rehearsal — is exercised here
+      # against a stub `gh`, because in the workflow it runs once, on a
+      # tag, with no test around it.
+      - name: The release path is exercised
+        run: |
+          bash tests/release-assets-selftest.sh
+          bash scripts/classify_release_mode-selftest.sh
+          bash scripts/validate_release_aggregate-selftest.sh
   docs:
     name: docs-only-check
     runs-on: ubuntu-latest
     needs: [changes]
     if: needs.changes.outputs.docs_only == 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate whitespace and merge markers
         run: |
           set -euo pipefail
@@ -95,9 +113,9 @@ jobs:
     if: needs.changes.outputs.code_changed == 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt
       - name: Check formatting
@@ -111,9 +129,9 @@ jobs:
     if: needs.changes.outputs.code_changed == 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: clippy, rustfmt
       - name: Install Aegis
@@ -128,24 +146,24 @@ jobs:
       - name: Install wasm32 target
         run: rustup target add wasm32-unknown-unknown
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cargo/registry
           key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
       - name: Cache cargo index
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cargo/git
           key: cargo-index-${{ hashFiles('**/Cargo.lock') }}
       - name: Cache build artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: target
           key: cargo-build-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: cargo-build-${{ runner.os }}-
       - name: Cache cargo-llvm-cov
         id: cache-llvc
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cargo/bin/cargo-llvm-cov
           key: cargo-llvm-cov-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
@@ -154,7 +172,7 @@ jobs:
         run: cargo install cargo-llvm-cov --locked
       - name: Cache trunk
         id: cache-trunk
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cargo/bin/trunk
           key: trunk-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}

.github/workflows/deploy-site.yml

@@ -3,10 +3,14 @@ name: Deploy FireCraft marketing site
 on:
   push:
     branches: [main]
+    # The trigger is the deployed content, not this file. The workflow's own
+    # source is not part of the Pages deployment — the deploy step publishes
+    # `site/` — so listing it here made every edit to this file a production
+    # publication. Production deploys stay tied to a change in what is
+    # published; a deliberate redeploy is `workflow_dispatch`.
     paths:
       - "site/**"
       - "wrangler.toml"
-      - ".github/workflows/deploy-site.yml"
   workflow_dispatch:
 
 permissions:
@@ -22,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate static site
         run: |
           test -s site/index.html
@@ -33,7 +37,7 @@ jobs:
           grep -q 'prefers-reduced-motion' site/styles.css
           grep -q 'loadRelease' site/app.js
       - name: Deploy to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}