Backport workflow-hardening fix (unpinned-uses) to 3 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/ci.yml against the issue(s) below, but 3 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

• 1501f46

Affected release branches (3)

• 2.21 (still present as of HEAD 6feb9c90)
• 2.20 (still present as of HEAD 474d3eef)
• 2.19 (still present as of HEAD 3fceda6d)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

2.21 — unpinned-uses

File .github/workflows/ci.yml; suggested edits:

• ~ jobs.$J2.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J3.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J3.steps[uses=actions/setup-node].uses : pin(actions/setup-node -> target_ref SHA)
• ~ jobs.$J4.steps[uses=DoozyX/clang-format-lint-action].uses : pin(DoozyX/clang-format-lint-action -> target_ref SHA)
• ~ jobs.$J4.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J5.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J5.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J6.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J6.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions-rs/clippy-check].uses : pin(actions-rs/clippy-check -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -188,7 +188,7 @@
           architecture: 'x64'
       - name: 'Cache Cargo artifacts'
         if: matrix.mode == 'native'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             tensorboard/data/server/target/
@@ -239,7 +239,7 @@
             --out-dir /tmp/pip_package \
             ;
       - name: 'Upload'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: tensorboard-data-server_${{ matrix.mode }}_${{ matrix.platform }}_${{ matrix.rust_version }}
           path: /tmp/pip_package/*
@@ -307,7 +307,7 @@
     steps:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: 'Cache Cargo artifacts'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             tensorboard/data/server/target/

2.20 — unpinned-uses

File .github/workflows/ci.yml; suggested edits:

• ~ jobs.$J2.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J3.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J3.steps[uses=actions/setup-node].uses : pin(actions/setup-node -> target_ref SHA)
• ~ jobs.$J4.steps[uses=DoozyX/clang-format-lint-action].uses : pin(DoozyX/clang-format-lint-action -> target_ref SHA)
• ~ jobs.$J4.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J5.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J5.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J6.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J6.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions-rs/clippy-check].uses : pin(actions-rs/clippy-check -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -160,7 +160,7 @@
           architecture: 'x64'
       - name: 'Cache Cargo artifacts'
         if: matrix.mode == 'native'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             tensorboard/data/server/target/
@@ -211,7 +211,7 @@
             --out-dir /tmp/pip_package \
             ;
       - name: 'Upload'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: tensorboard-data-server_${{ matrix.mode }}_${{ matrix.platform }}_${{ matrix.rust_version }}
           path: /tmp/pip_package/*
@@ -279,7 +279,7 @@
     steps:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: 'Cache Cargo artifacts'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             tensorboard/data/server/target/

2.19 — unpinned-uses

File .github/workflows/ci.yml; suggested edits:

• ~ jobs.$J2.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J3.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J3.steps[uses=actions/setup-node].uses : pin(actions/setup-node -> target_ref SHA)
• ~ jobs.$J4.steps[uses=DoozyX/clang-format-lint-action].uses : pin(DoozyX/clang-format-lint-action -> target_ref SHA)
• ~ jobs.$J4.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J5.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J5.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J6.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
• ~ jobs.$J6.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions-rs/clippy-check].uses : pin(actions-rs/clippy-check -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
• ~ jobs.$J7.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -211,7 +211,7 @@
             --out-dir /tmp/pip_package \
             ;
       - name: 'Upload'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: tensorboard-data-server_${{ matrix.mode }}_${{ matrix.platform }}_${{ matrix.rust_version }}
           path: /tmp/pip_package/*

---

Happy to open pull requests instead if that's preferred.