ci: pin third-party GitHub Actions to commit SHAs

.github/workflows/audit.yaml

@@ -30,8 +30,10 @@ jobs:
     name: Audit Latest Dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: dtolnay/rust-toolchain@master
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      # Pinned to the commit hash of master
+      - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537
         with:
           toolchain: ${{ env.rust_version }}
       - name: install cargo audit
@@ -44,8 +46,10 @@ jobs:
     name: Audit Minimal Versions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: dtolnay/rust-toolchain@master
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      # Pinned to the commit hash of master
+      - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537
         with:
           toolchain: ${{ env.rust_version }}
       - name: install cargo audit

.github/workflows/canary.yaml

@@ -15,12 +15,15 @@ jobs:
     runs-on: ubuntu-latest
     name: Generate Canary Matrix
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/checkout@v4
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           repository: awslabs/smithy-rs
           path: smithy-rs
-      - uses: dtolnay/rust-toolchain@master
+      # Pinned to the commit hash of master
+      - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537
         with:
           toolchain: ${{ env.tool_rust_version }}
       - name: Generate the matrix
@@ -54,7 +57,8 @@ jobs:
       # Use the matrix generated by the previous job
       matrix: ${{ fromJson(needs.generate-canary-matrix.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v4
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           repository: awslabs/smithy-rs
           path: smithy-rs
@@ -65,7 +69,8 @@ jobs:
       - name: Delete `rust-toolchain.toml`
         working-directory: smithy-rs
         run: rm rust-toolchain.toml
-      - uses: dtolnay/rust-toolchain@master
+      # Pinned to the commit hash of master
+      - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537
         with:
           toolchain: ${{ matrix.rust_version }}
           targets: x86_64-unknown-linux-musl

.github/workflows/ci.yaml

@@ -21,7 +21,8 @@ jobs:
     runs-on: ubuntu-latest
     name: Generate Test Matrix (SDK)
     steps:
-      - uses: actions/checkout@v3
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - name: Generate the matrix
         id: generate-matrix
         # Run the `crate-range.py` script to calculate a matrix for the `test-sdk` job.
@@ -43,8 +44,10 @@ jobs:
       # Use the matrix generated by the previous job
       matrix: ${{ fromJson(needs.generate-test-sdk-matrix.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v3
-      - uses: dtolnay/rust-toolchain@master
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      # Pinned to the commit hash of master
+      - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537
         with:
           toolchain: ${{ matrix.rust_version }}
       # Pinned to the commit hash of v2.1.0
@@ -74,12 +77,15 @@ jobs:
   check-manifests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/checkout@v3
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           repository: awslabs/smithy-rs
           path: smithy-rs
-      - uses: dtolnay/rust-toolchain@master
+      # Pinned to the commit hash of master
+      - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537
         with:
           toolchain: "${{ env.RUST_VERSION }}"
       # Pinned to the commit hash of v2.1.0

.github/workflows/issue-regression-labeler.yml

@@ -11,7 +11,8 @@ jobs:
     steps:
     - name: Fetch template body
       id: check_regression
-      uses: actions/github-script@v7
+      # Pinned to the commit hash of v7.1.0
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
       env: 
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         TEMPLATE_BODY: ${{ github.event.issue.body }}

.github/workflows/release-checks.yaml

@@ -14,8 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Check Release config.json
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/checkout@v4
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      # Pinned to the commit hash of v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           ref: main
           path: main-branch