ci: unstick star chart, fix weekly benchmarks, pin all actions to Node 24 SHAs

.github/workflows/amalgamation-drift.yml

@@ -36,7 +36,7 @@ jobs:
       run:
         working-directory: rust
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: zackees/setup-soldr@v0
         with:
           # Save caches fully under act (local bosn runs are pull_request events); setup-soldr#537 makes this the default. Remove then.

.github/workflows/asan.yml

@@ -90,7 +90,7 @@ jobs:
       CC: ${{ matrix.cc }}
       CXX: ${{ matrix.cxx }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # MI_TRACK_ASAN silently turns itself OFF if sanitizer/asan_interface.h is
       # missing, which would leave this job green while sanitizing nothing. Fail
@@ -162,7 +162,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # verify_local SKIPS the tsan config without clang: a skipped sanitizer is a green job that
       # sanitized nothing, so fail here instead.
       - name: clang is present

.github/workflows/auto-release.yml

@@ -106,7 +106,7 @@ jobs:
       contents: read
       issues: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
           fetch-depth: 0
@@ -131,7 +131,7 @@ jobs:
       run:
         working-directory: rust
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
       - name: Verify package checkout is the release candidate
@@ -183,7 +183,7 @@ jobs:
           cp "$crate" dist/crate/
 
       - name: Upload exact packaged crate
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-crate-${{ inputs.candidate_sha }}
           path: rust/dist/crate/*.crate
@@ -205,7 +205,7 @@ jobs:
           cp "$RUNNER_TEMP/mimalloc-pprof-c.zip" dist/
 
       - name: Upload release ZIP artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mimalloc-pprof-c-zip
           path: rust/dist/mimalloc-pprof-c.zip
@@ -240,15 +240,15 @@ jobs:
             triple: x86_64-pc-windows-msvc
             archive: zip
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
       - name: Verify binary checkout is the release candidate
         env:
           CANDIDATE_SHA: ${{ inputs.candidate_sha }}
         run: |
           [[ "$CANDIDATE_SHA" =~ ^[0-9a-f]{40}$ ]] && test "$(git rev-parse HEAD)" = "$CANDIDATE_SHA" || { echo '::error::binary checkout differs from candidate_sha'; exit 1; }
-      - uses: astral-sh/setup-uv@v3
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - uses: zackees/setup-soldr@v0
         with:
           version: v0.9.11  # pinned: v0.9.12 archive lacks the binary (zackees/soldr#3091)
@@ -258,7 +258,7 @@ jobs:
           lockfile: rust/Cargo.lock
           target-dir: rust/target
       - name: Cache the prepared ${{ matrix.triple }} toolchain
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           # Deliberately the same path and key macos-bundles.yml / windows-bundles.yml use,
           # so a release run hits the cache those workflows already warmed on this commit.
@@ -325,7 +325,7 @@ jobs:
             *) uv run ci/bundle_tests.py build release-test-bundle ;;
           esac
           tar -C release-test-bundle -czf release-test-bundle.tar.gz .
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-test-bundle-${{ matrix.asset }}
           path: release-test-bundle.tar.gz
@@ -472,7 +472,7 @@ jobs:
             (cd stage && zip -r "$GITHUB_WORKSPACE/dist/${name}.zip" .)
           fi
           ls -l dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-binaries-${{ matrix.asset }}
           path: dist/*
@@ -502,17 +502,17 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-binaries-${{ matrix.asset }}
           path: dist
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-test-bundle-${{ matrix.asset }}
           path: test-input
@@ -551,14 +551,14 @@ jobs:
       actions: read
       issues: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: mimalloc-pprof-c-zip
           path: dist
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-binaries-*
           merge-multiple: true
@@ -589,7 +589,7 @@ jobs:
           ISSUE_NUMBER: ${{ inputs.issue_number }}
           CANDIDATE_SHA: ${{ inputs.candidate_sha }}
         run: python3 ci/release.py preflight-artifacts --issue "$ISSUE_NUMBER" --candidate-sha "$CANDIDATE_SHA" --dist dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-preflight-${{ inputs.candidate_sha }}
           path: dist/
@@ -608,7 +608,7 @@ jobs:
       id-token: write
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
           fetch-depth: 0 # origin/main is needed to prove a real candidate was merged
@@ -702,12 +702,12 @@ jobs:
           build-cache-mode: full
 
       - name: Download archives already tested on native hosts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-preflight-${{ inputs.candidate_sha }}
           path: dist
       - name: Download exact packaged crate
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-crate-${{ inputs.candidate_sha }}
           path: release-crate
@@ -785,14 +785,14 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
       - name: Download exact worker preflight archive and info.json
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-preflight-${{ inputs.candidate_sha }}
           path: dist
@@ -842,7 +842,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
       - name: Append run URL and outcome to the release control issue

.github/workflows/benchmark-arena-reclaim.yml

@@ -18,18 +18,18 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: d5bdb464debf59d0816eeac038d9d4423736c9c4
           path: baseline-main
       - name: Measure paired runs
         run: |
           python3 ci/bench_arena_reclaim.py --measure --toolchain unix --build-root "$RUNNER_TEMP/arena-build-pr" --data "$RUNNER_TEMP/arena-reclaim-linux-pr.json" --runs 3
           python3 ci/bench_arena_reclaim.py --measure --toolchain unix --build-root "$RUNNER_TEMP/arena-build-main" --allocator-source baseline-main --allocator-source-sha d5bdb464debf59d0816eeac038d9d4423736c9c4 --data "$RUNNER_TEMP/arena-reclaim-linux-main.json" --runs 3
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: arena-reclaim-linux
           path: ${{ runner.temp }}/arena-reclaim-linux-*.json
@@ -38,10 +38,10 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: d5bdb464debf59d0816eeac038d9d4423736c9c4
           path: baseline-main
@@ -50,7 +50,7 @@ jobs:
         run: |
           python ci/bench_arena_reclaim.py --measure --toolchain msvc --build-root "$RUNNER_TEMP/arena-build-pr" --data "$RUNNER_TEMP/arena-reclaim-msvc-pr.json" --runs 3
           python ci/bench_arena_reclaim.py --measure --toolchain msvc --build-root "$RUNNER_TEMP/arena-build-main" --allocator-source baseline-main --allocator-source-sha d5bdb464debf59d0816eeac038d9d4423736c9c4 --data "$RUNNER_TEMP/arena-reclaim-msvc-main.json" --runs 3
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: arena-reclaim-msvc
           path: ${{ runner.temp }}/arena-reclaim-msvc-*.json
@@ -59,14 +59,14 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: d5bdb464debf59d0816eeac038d9d4423736c9c4
           path: baseline-main
-      - uses: msys2/setup-msys2@v2
+      - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0
         with:
           msystem: MINGW64
           install: mingw-w64-x86_64-gcc mingw-w64-x86_64-cmake mingw-w64-x86_64-ninja mingw-w64-x86_64-python
@@ -75,7 +75,7 @@ jobs:
         run: |
           python ci/bench_arena_reclaim.py --measure --toolchain mingw --build-root "$RUNNER_TEMP/arena-build-pr" --data "$RUNNER_TEMP/arena-reclaim-mingw-pr.json" --runs 3
           python ci/bench_arena_reclaim.py --measure --toolchain mingw --build-root "$RUNNER_TEMP/arena-build-main" --allocator-source baseline-main --allocator-source-sha d5bdb464debf59d0816eeac038d9d4423736c9c4 --data "$RUNNER_TEMP/arena-reclaim-mingw-main.json" --runs 3
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: arena-reclaim-mingw
           path: ${{ runner.temp }}/arena-reclaim-mingw-*.json

.github/workflows/benchmark-large-span-diagnostic.yml

@@ -36,7 +36,7 @@ jobs:
       RUN_LOCAL_ID: gha-${{ github.run_id }}-${{ github.run_attempt }}
       OUTPUT_DIR: ${{ github.workspace }}/.large-span-diagnostic-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
-      - uses: actions/checkout@v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate_sha }}
           fetch-depth: 0
@@ -149,7 +149,7 @@ jobs:
             --output "$OUTPUT_DIR/large-span-scaling-refs.json"
       - name: upload raw diagnostic artifacts
         if: always()
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: large-span-diagnostic-${{ github.run_id }}-${{ github.run_attempt }}
           overwrite: true

.github/workflows/benchmark-latency.yml

@@ -43,7 +43,7 @@ jobs:
       mode: ${{ inputs.mode || 'full' }}
       prior_branch_sha: ${{ steps.prior.outputs.prior_sha }}
     steps:
-      - uses: actions/checkout@v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # Fail before any build if the lockfile setup-soldr's yank audit reads is
@@ -155,7 +155,7 @@ jobs:
           echo "publish_eligible=$ELIGIBLE" >> "$GITHUB_OUTPUT"
       - name: upload raw latency artifact
         if: always()
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: benchmark-latency-raw-${{ github.run_id }}
           overwrite: true   # a re-run of this job replaces attempt 1's upload (#341)
@@ -165,7 +165,7 @@ jobs:
           if-no-files-found: error
       - name: upload validation artifact
         if: (inputs.mode || 'full') == 'full' && always()
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: benchmark-latency-validation-${{ github.run_id }}
           overwrite: true   # a re-run of this job replaces attempt 1's upload (#341)
@@ -176,7 +176,7 @@ jobs:
           if-no-files-found: error
       - name: upload site artifact
         if: (inputs.mode || 'full') == 'full' && success()
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: benchmark-latency-site-${{ github.run_id }}
           overwrite: true   # a re-run of this job replaces attempt 1's upload (#341)
@@ -193,14 +193,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: benchmark-latency-site-${{ github.run_id }}
           path: audit/site/
-      - uses: actions/download-artifact@v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: benchmark-latency-validation-${{ github.run_id }}
           path: audit/validation/
@@ -218,10 +218,10 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: benchmark-latency-site-${{ github.run_id }}
           path: site-temp/
@@ -256,11 +256,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/download-artifact@v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: benchmark-latency-site-${{ github.run_id }}
           path: _site/
-      - uses: actions/upload-pages-artifact@v4.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: _site/
           include-hidden-files: true
@@ -279,7 +279,7 @@ jobs:
     outputs:
       page_url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/deploy-pages@v4.0.5
+      - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
         id: deployment
 
   publication-audit:
@@ -290,10 +290,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: benchmark-latency-site-${{ github.run_id }}
           path: audit/site/