ci: pin persistent runner actions

Author: apstenku123

.github/workflows/ci-self-hosted.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Run focused MLX contract suite
         shell: bash
         run: |
@@ -47,8 +47,8 @@ jobs:
     runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.13"
       - name: Install portable test dependencies

.github/workflows/e2e-matrix.yml

@@ -39,8 +39,8 @@ jobs:
       matrix:
         shard: [1, 2, 3, 4]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -81,7 +81,7 @@ jobs:
             --shard=${{ matrix.shard }}/4
       - name: Upload artefacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: preset-matrix-shard-${{ matrix.shard }}
           path: |
@@ -97,8 +97,8 @@ jobs:
     runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: { node-version: "22", cache: "npm",
                 cache-dependency-path: vbgui/package-lock.json }
       - name: Create isolated MLX Python
@@ -131,7 +131,7 @@ jobs:
             e2e/scenarios/06_sharding_proposals.spec.ts \
             e2e/scenarios/07_gotchas.spec.ts
       - if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: specialised-results
           path: |
@@ -147,8 +147,8 @@ jobs:
     runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: { node-version: "22", cache: "npm",
                 cache-dependency-path: vbgui/package-lock.json }
       - name: Create isolated MLX Python
@@ -177,7 +177,7 @@ jobs:
           npx playwright test --config=e2e/playwright.config.ts \
             e2e/scenarios/03_train_matrix.spec.ts
       - if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: mini-train-results
           path: |
@@ -194,18 +194,18 @@ jobs:
     runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with: { path: artifacts }
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: { python-version: "3.13" }
       - name: Build matrix report
         run: |
           python tools/build_e2e_matrix_report.py \
             --artifacts artifacts \
             --output e2e_matrix_report.md
           cat e2e_matrix_report.md >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: e2e_matrix_report
           path: e2e_matrix_report.md

tests/test_workflow_runner_policy.py

@@ -21,6 +21,10 @@
     "github.event_name == 'schedule' || "
     "github.event_name == 'workflow_dispatch'"
 )
+ACTION_USE = re.compile(
+    r"uses:\s*['\"]?(?P<action>actions/[A-Za-z0-9_.-]+)"
+    r"@(?P<ref>[^\s'\"#]+)"
+)
 
 
 def test_workflows_do_not_use_github_hosted_runners() -> None:
@@ -56,6 +60,21 @@ def test_pull_requests_cannot_execute_on_persistent_self_hosted_runners() -> Non
     )
 
 
+def test_persistent_pr_ci_actions_are_pinned_to_commits() -> None:
+    violations = []
+    for name in ("ci-self-hosted.yml", "e2e-matrix.yml"):
+        workflow = (
+            REPO_ROOT / ".github" / "workflows" / name
+        ).read_text(encoding="utf-8")
+        violations.extend(
+            f"{name}:{match.group('action')}@{match.group('ref')}"
+            for match in ACTION_USE.finditer(workflow)
+            if re.fullmatch(r"[0-9a-f]{40}", match.group("ref")) is None
+        )
+
+    assert not violations, f"mutable action references are forbidden: {violations}"
+
+
 def test_macos_e2e_uses_an_isolated_job_venv() -> None:
     workflow = (REPO_ROOT / ".github" / "workflows" / "e2e-matrix.yml").read_text(
         encoding="utf-8"