Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/bloat.yml

@@ -116,19 +116,19 @@ jobs:
             crate_share_overrides: "clap_builder=0.25 regex_automata=0.20 regex_syntax=0.15"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install apt packages (Linux only)
         if: runner.os == 'Linux' && matrix.apt_packages != ''
         run: |
           sudo apt-get update
           sudo apt-get install -y ${{ matrix.apt_packages }}
 
-      - uses: dtolnay/rust-toolchain@1.95.0
+      - uses: dtolnay/rust-toolchain@a5f673d0ba8626c3977bb416a1612774bc82181b # 1.95.0
         with:
           targets: ${{ matrix.target }}
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: bloat-${{ matrix.target }}-${{ matrix.crate }}
 
@@ -159,7 +159,7 @@ jobs:
 
       - name: Upload bloat report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: bloat-report-${{ matrix.target }}-${{ matrix.crate }}
           path: |

.github/workflows/ci.yml

@@ -17,13 +17,13 @@ jobs:
   linux_lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Install eBPF build dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y libbpf-dev libbpfcc-dev clang llvm
-      - uses: Swatinem/rust-cache@v2
-      - uses: dtolnay/rust-toolchain@1.95.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: dtolnay/rust-toolchain@a5f673d0ba8626c3977bb416a1612774bc82181b # 1.95.0
         with:
           components: rustfmt clippy
       - run: cargo fmt --all -- --check -l
@@ -37,9 +37,9 @@ jobs:
   win_lint:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
-      - uses: Swatinem/rust-cache@v2
-      - uses: dtolnay/rust-toolchain@1.95.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: dtolnay/rust-toolchain@a5f673d0ba8626c3977bb416a1612774bc82181b # 1.95.0
         with:
           components: rustfmt clippy
       - run: cargo fmt --all -- --check -l

.github/workflows/codeql.yml

@@ -58,10 +58,10 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Install Clang
-      uses: egor-tensin/setup-clang@v1
+      uses: egor-tensin/setup-clang@ef434b41eb33a70396fb336b1bae39c76d740c3d # v1.4
 
     - name: Setup an eBPF Development Environment in Ubuntu
       run: |
@@ -83,7 +83,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -113,6 +113,6 @@ jobs:
         fi
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/reusable-build.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Create GitHub Release
         id: create_release
         if: inputs.generate_release == true
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -31,18 +31,18 @@ jobs:
 
     steps:
       - name: Checkout Project
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
 
       - name: Install Clang
         working-directory: ${{env.GITHUB_WORKSPACE}}
         run: |
           choco install -y llvm --version 11.0.1 --allow-downgrade
 
       - name: setup-msbuild
-        uses: microsoft/setup-msbuild@v1.3.1
+        uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # v1.3.1
 
       - name: rust-toolchain
-        uses: actions-rs/toolchain@v1.0.6
+        uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6
         with:
           toolchain: stable
 
@@ -54,7 +54,7 @@ jobs:
 
       - name: Upload debug amd64 build zip packages
         if: (success() || failure())
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # Artifact name
           name: build-debug-windows-amd64.zip
@@ -67,7 +67,7 @@ jobs:
 
       - name: Upload release amd64 build zip package
         if: (success() || failure())
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # Artifact name
           name: build-release-windows-amd64.zip
@@ -146,7 +146,7 @@ jobs:
       - name: get current release
         id: get_current_release
         if: inputs.generate_release == true
-        uses: joutvhu/get-release@v1.0.2
+        uses: joutvhu/get-release@144629279c62511778ae157f397f35c358626160 # v1.0.2
         with:
           # do not push two tags/releases at the same time
           latest: true
@@ -155,7 +155,7 @@ jobs:
 
       - name: Upload debug amd64 build
         if: inputs.generate_release == true
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -168,7 +168,7 @@ jobs:
 
       - name: Upload release amd64 build
         if: inputs.generate_release == true
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -185,18 +185,18 @@ jobs:
 
     steps:
       - name: Checkout Project
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
 
       - name: Install Clang
         working-directory: ${{env.GITHUB_WORKSPACE}}
         run: |
           choco install -y llvm --version 11.0.1 --allow-downgrade
 
       - name: setup-msbuild
-        uses: microsoft/setup-msbuild@v1.3.1
+        uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # v1.3.1
 
       - name: rust-toolchain
-        uses: actions-rs/toolchain@v1.0.6
+        uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6
         with:
           toolchain: stable
 
@@ -205,7 +205,7 @@ jobs:
 
       - name: Upload debug arm64 build zip packages
         if: (success() || failure())
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # Artifact name
           name: build-debug-windows-arm64.zip
@@ -218,7 +218,7 @@ jobs:
 
       - name: Upload release arm64 build zip package
         if: (success() || failure())
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # Artifact name
           name: build-release-windows-arm64.zip
@@ -228,7 +228,7 @@ jobs:
       - name: get current release
         id: get_current_release
         if: inputs.generate_release == true
-        uses: joutvhu/get-release@v1.0.2
+        uses: joutvhu/get-release@144629279c62511778ae157f397f35c358626160 # v1.0.2
         with:
           # do not push two tags/releases at the same time
           latest: true
@@ -237,7 +237,7 @@ jobs:
 
       - name: Upload debug arm64 build
         if: inputs.generate_release == true
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -250,7 +250,7 @@ jobs:
 
       - name: Upload release arm64 build
         if: inputs.generate_release == true
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -267,13 +267,13 @@ jobs:
 
     steps:
       - name: Checkout Project
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
 
       - name: Install Clang
-        uses: egor-tensin/setup-clang@v1
+        uses: egor-tensin/setup-clang@ef434b41eb33a70396fb336b1bae39c76d740c3d # v1.4
 
       - name: rust-toolchain
-        uses: actions-rs/toolchain@v1.0.6
+        uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6
         with:
           toolchain: stable
 
@@ -304,7 +304,7 @@ jobs:
         run: ./build-linux.sh debug amd64
 
       - name: Upload debug build amd64 zip package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # Artifact name
           name: build-debug-linux-amd64.zip
@@ -315,7 +315,7 @@ jobs:
         run: ./build-linux.sh release
 
       - name: Upload release amd64 build zip package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # Artifact name
           name: build-release-linux-amd64.zip
@@ -403,7 +403,7 @@ jobs:
       - name: get current release
         id: get_current_release
         if: inputs.generate_release == true
-        uses: joutvhu/get-release@v1.0.2
+        uses: joutvhu/get-release@144629279c62511778ae157f397f35c358626160 # v1.0.2
         with:
           # do not push two tags/releases at the same time
           latest: true
@@ -412,7 +412,7 @@ jobs:
 
       - name: Upload debug build
         if: inputs.generate_release == true
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -425,7 +425,7 @@ jobs:
 
       - name: Upload release build
         if: inputs.generate_release == true
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -442,13 +442,13 @@ jobs:
 
     steps:
       - name: Checkout Project
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
 
       - name: Install Clang
-        uses: egor-tensin/setup-clang@v1
+        uses: egor-tensin/setup-clang@ef434b41eb33a70396fb336b1bae39c76d740c3d # v1.4
 
       - name: rust-toolchain
-        uses: actions-rs/toolchain@v1.0.6
+        uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6
         with:
           toolchain: stable
 
@@ -475,7 +475,7 @@ jobs:
         run: ./build-linux.sh debug arm64
 
       - name: Upload debug arm64 build zip package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # Artifact name
           name: build-debug-linux-arm64.zip
@@ -486,7 +486,7 @@ jobs:
         run: ./build-linux.sh release arm64
 
       - name: Upload release arm64 build zip package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # Artifact name
           name: build-release-linux-arm64.zip
@@ -496,7 +496,7 @@ jobs:
       - name: get current release
         id: get_current_release
         if: inputs.generate_release == true
-        uses: joutvhu/get-release@v1.0.2
+        uses: joutvhu/get-release@144629279c62511778ae157f397f35c358626160 # v1.0.2
         with:
           # do not push two tags/releases at the same time
           latest: true
@@ -505,7 +505,7 @@ jobs:
 
       - name: Upload debug build
         if: inputs.generate_release == true
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -518,7 +518,7 @@ jobs:
 
       - name: Upload release build
         if: inputs.generate_release == true
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/spelling.yml

@@ -18,10 +18,10 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Check Spelling
-        uses: streetsidesoftware/cspell-action@v8
+        uses: streetsidesoftware/cspell-action@de2a73e963e7443969755b648a1008f77033c5b2 # v8.4.0
         with:
           config: cspell.json
           # On pull requests, only check files changed in the PR.