From c903840ed15fa1f1314ded9f70f30d0897873ee1 Mon Sep 17 00:00:00 2001
From: Mihai Nueleanu <hey@dotmethod.me>
Date: Fri, 30 Oct 2026 22:38:27 +0000
Subject: [PATCH] fix(ci): pin actions to commits and move them off v4

Every third-party action is now pinned to a commit SHA with the release in a
trailing comment, so a repointed tag cannot swap the code under the build.

- actions/checkout v4 -> v7.0.1
- actions/upload-artifact v4 -> v7.0.2
- actions/download-artifact v4 -> v8.0.2 (hash mismatch now fails the run)
- Swatinem/rust-cache v2 -> v2.9.3
- dtolnay/rust-toolchain: pinned to a master commit, toolchain named explicitly

All of them run on Node 24 now, which clears the checkout/upload-artifact
Node 20 deprecation annotations.
---
 .github/workflows/release.yaml | 35 ++++++++++++++++++++++------------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 954f8fa..81557dc 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -17,6 +17,12 @@ name: Release
 # Platforms: Linux x86_64 and macOS arm64. Windows is deliberately absent:
 # `config.rs` falls back to `$HOME/.config`, which Windows does not set, so the
 # app would write its state into the working directory. Fix that first.
+#
+# Third-party actions are pinned to a commit SHA with the release it came from
+# in a trailing comment. A tag is a mutable pointer that can be repointed at
+# other code, so `@v7` is both a supply-chain hole and a silent upgrade; the
+# comment is what makes the SHA readable. To move a pin: bump the SHA, the
+# comment and the tag it names in the same line.
 
 on:
   push:
@@ -42,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: System libraries for egui/winit
         run: |
@@ -53,12 +59,15 @@ jobs:
             libgl1-mesa-dev libwayland-dev pkg-config
 
       - name: Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        # dtolnay/rust-toolchain has no release tags: `@stable` is a branch head,
+        # so the pin is a commit on master and the toolchain is named explicitly
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master 2026-10-30
         with:
+          toolchain: stable
           components: rustfmt, clippy
 
       - name: Cache the build
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: ". -> target"
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -82,7 +91,7 @@ jobs:
       bump: ${{ steps.next.outputs.bump }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # the version and the notes come from the history since the last tag
           fetch-depth: 0
@@ -98,7 +107,7 @@ jobs:
           echo "--- notes ---"; cat notes.md
 
       - name: Keep the notes for the publish job
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-notes
           path: notes.md
@@ -124,7 +133,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: System libraries for egui/winit
         if: runner.os == 'Linux'
@@ -136,10 +145,12 @@ jobs:
             libgl1-mesa-dev libwayland-dev pkg-config
 
       - name: Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master 2026-10-30
+        with:
+          toolchain: stable
 
       - name: Cache the build
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: ". -> target"
           # separate cache per platform, or the mac and linux artifacts fight
@@ -166,7 +177,7 @@ jobs:
           ls -l dist
 
       - name: Keep the archive for the publish job
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: kubetitan-${{ matrix.platform }}
           path: dist/*.tar.gz
@@ -179,10 +190,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Collect the archives
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           # every platform's job, flattened into one directory
           pattern: kubetitan-*
@@ -190,7 +201,7 @@ jobs:
           merge-multiple: true
 
       - name: Collect the notes
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-notes