pin GitHub Actions to commit SHA (#2388)

* pin GitHub Actions to commit SHA

* fix conflict

Author: sobhe-Starkware

.github/workflows/bench.yml

@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@1.89.0
+      uses: dtolnay/rust-toolchain@451ce45ce31d200b52705aadd15ce75018b006de # 1.89.0
       with:
           components: rustfmt, clippy
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       with:
         enable-cache: true
     - name: Install python deps
@@ -31,7 +31,7 @@ jobs:
     - name: Run benchmark
       run: make benchmark-action
     - name: Store benchmark result
-      uses: benchmark-action/github-action-benchmark@v1
+      uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1
       with:
         tool: 'cargo'
         output-file-path: output.txt

.github/workflows/cairo_1_programs.yml

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.89.0
+        uses: dtolnay/rust-toolchain@451ce45ce31d200b52705aadd15ce75018b006de # 1.89.0
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Set up Cargo cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - name: install corelib
         run:  cd cairo1-run/ && make deps
       - name: Run tests

.github/workflows/changelog.yml

@@ -11,6 +11,6 @@ jobs:
   changelog:
     runs-on: ubuntu-latest
     steps:
-    - uses: dangoslen/changelog-enforcer@v3
+    - uses: dangoslen/changelog-enforcer@204e7d3ef26579f4cd0fd759c57032656fdf23c7 # v3
       with:
         skipLabels: nochangelog,pipelines,tests,documentation

.github/workflows/fresh_run.yml

@@ -35,13 +35,13 @@ jobs:
         sudo rm -rf "$AGENT_TOOLSDIRECTORY"
 
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@1.89.0
+      uses: dtolnay/rust-toolchain@451ce45ce31d200b52705aadd15ce75018b006de # 1.89.0
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       with:
         enable-cache: true
 
@@ -80,7 +80,7 @@ jobs:
 
     - name: Create Issue
       if: ${{ failure() }}
-      uses: JasonEtco/create-an-issue@v2
+      uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         OS: ${{ matrix.os_name}}

.github/workflows/fuzzer.yml

@@ -11,14 +11,14 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         ref: ${{ github.head_ref }}
 
 
     - name: Cache Inputs
       id: cache-inputs
-      uses: actions/cache@v3
+      uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
       with:
       # Path where the inputs for the fuzzer are stored
         path: fuzzer/hfuzz_workspace/fuzz_json/input
@@ -51,14 +51,14 @@ jobs:
         cd fuzzer
         HFUZZ_RUN_ARGS="--dict=json.dict --minimize --timeout 60 -T" cargo hfuzz run fuzz_json
 
-    - uses: stefanzweifel/git-auto-commit-action@v4
+    - uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a # v4
       with:
         commit_message: changing report
         file_pattern: '*/hfuzz_workspace/fuzzer/fuzz_json/HONGGFUZZ*  */hfuzz_workspace/fuzzer/fuzz_json/*.fuzz'
 
     # Checkout current and last commit for the diff
     - name: Checkout commits
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         fetch-depth: 2
 
@@ -69,7 +69,7 @@ jobs:
 
     # If a new crash was found, create an issue
     - name: Create issue
-      uses: JasonEtco/create-an-issue@v2
+      uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2
       if: ${{ steps.check_file_changed.outputs.report != '' }}
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/hint_accountant.yml

@@ -12,19 +12,19 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@1.89.0
+      uses: dtolnay/rust-toolchain@451ce45ce31d200b52705aadd15ce75018b006de # 1.89.0
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Set up Cargo cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
     - name: Check Build
       run: cargo build -p hint_accountant
     - name: Clone cairo-lang repo
       run: git clone  --depth=1 https://github.com/starkware-libs/cairo-lang
     - name: Run the hint accounting script
       run: cargo r -p hint_accountant | tee comment.md
     - name: Update comment in tracking issue
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       with:
         issue-number: 1031
         comment-id: 1518234161

.github/workflows/hyper_threading_benchmarks.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout PR
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       with:
         enable-cache: true
 
@@ -28,7 +28,7 @@ jobs:
         sudo apt-get install -y hyperfine
 
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@1.89.0
+      uses: dtolnay/rust-toolchain@451ce45ce31d200b52705aadd15ce75018b006de # 1.89.0
       with:
         components: rustfmt, clippy
 
@@ -39,20 +39,20 @@ jobs:
         cp ./examples/hyper_threading/hyper-threading-workflow.sh ${{ github.workspace }}/hyper-threading-workflow.sh
 
     - name: Upload PR Binary
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: hyper_threading_pr_binary
         path: ${{ github.workspace }}/hyper_threading_pr
 
     - name: Upload Workflow Script
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: hyper_threading_workflow_script
         path: ${{ github.workspace }}/hyper-threading-workflow.sh
 
 
     - name: Checkout Main Branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         ref: 'main'
 
@@ -62,13 +62,13 @@ jobs:
         cp target/release/hyper_threading ${{ github.workspace }}/hyper_threading_main
 
     - name: Download hyper_threading_pr_binary
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: hyper_threading_pr_binary
         path: ${{ github.workspace }}/
 
     - name: Download hyper_threading_workflow_script
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: hyper_threading_workflow_script
         path: ${{ github.workspace }}/
@@ -97,7 +97,7 @@ jobs:
         cat result.md
 
     - name: Find comment
-      uses: peter-evans/find-comment@v2
+      uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2
       id: fc
       with:
         issue-number: ${{ github.event.pull_request.number }}
@@ -106,14 +106,14 @@ jobs:
 
     - name: Create comment
       if: steps.fc.outputs.comment-id == ''
-      uses: peter-evans/create-or-update-comment@v3
+      uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3
       with:
         issue-number: ${{ github.event.pull_request.number }}
         body-path: result.md
 
     - name: Update comment
       if: steps.fc.outputs.comment-id != ''
-      uses: peter-evans/create-or-update-comment@v3
+      uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3
       with:
         comment-id: ${{ steps.fc.outputs.comment-id }}
         body-path: result.md

.github/workflows/hyperfine.yml

@@ -23,12 +23,12 @@ jobs:
       benchmark-hashes-head: ${{ steps.export-hashes.outputs.benchmark-hashes-head }}
     steps:
       - name: Checkout base commit
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request[matrix.branch].sha }}
 
       - name: Fetch from cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: cache
         with:
           path: ${{ matrix.branch }}_programs/*.json
@@ -37,7 +37,7 @@ jobs:
 
       - name: Install uv
         if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
           enable-cache: true
       - name: Install python deps
@@ -70,25 +70,25 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Populate cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: cache
         with:
           path: bin/cairo-vm-cli-${{ matrix.branch }}
           key: binary-${{ github.event.pull_request[matrix.branch].sha }}
 
       - name: Install Rust
         if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-        uses: dtolnay/rust-toolchain@1.89.0
+        uses: dtolnay/rust-toolchain@451ce45ce31d200b52705aadd15ce75018b006de # 1.89.0
 
       - name: Checkout
         if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request[matrix.branch].sha }}
 
       - name: Fetch Rust cache
         if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Build binary
         if: ${{ steps.cache.outputs.cache-hit != 'true' }}
@@ -107,30 +107,30 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Install Hyperfine
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # v2
       with:
         tool: hyperfine@1.19
 
     - name: Fetch base binary
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: bin/cairo-vm-cli-base
         key: binary-${{ github.event.pull_request.base.sha }}
 
     - name: Fetch HEAD binary
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: bin/cairo-vm-cli-head
         key: binary-${{ github.event.pull_request.head.sha }}
 
     - name: Fetch base programs
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: base_programs/*.json
         key: benchmarks-base-${{ needs.build-programs.outputs.benchmark-hashes-base }}
 
     - name: Fetch head programs
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: head_programs/*.json
         key: benchmarks-head-${{ needs.build-programs.outputs.benchmark-hashes-head }}
@@ -179,7 +179,7 @@ jobs:
 
     - name: Find comment
       if: ${{ steps.run-benchmarks.outputs.benchmark_count != 0 }}
-      uses: peter-evans/find-comment@v3
+      uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3
       id: fc
       with:
         issue-number: ${{ github.event.pull_request.number }}
@@ -188,14 +188,14 @@ jobs:
 
     - name: Create comment
       if: steps.fc.outputs.comment-id == '' && steps.run-benchmarks.outputs.benchmark_count != 0
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       with:
         issue-number: ${{ github.event.pull_request.number }}
         body-path: comment_body.md
 
     - name: Update comment
       if: steps.fc.outputs.comment-id != '' && steps.run-benchmarks.outputs.benchmark_count != 0
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       with:
         comment-id: ${{ steps.fc.outputs.comment-id }}
         body-path: comment_body.md

.github/workflows/iai_main.yml

@@ -9,13 +9,13 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@1.89.0
+      uses: dtolnay/rust-toolchain@451ce45ce31d200b52705aadd15ce75018b006de # 1.89.0
     - name: Set up cargo cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       with:
         enable-cache: true
     - name: Install python deps
@@ -34,7 +34,7 @@ jobs:
       run: make iai-benchmark-action
 
     - name: Save cache for ${{ github.sha }}
-      uses: actions/cache/save@v3
+      uses: actions/cache/save@6f8efc29b200d32929f49075959781ed54ec270c # v3
       with:
         path: |
           */target/iai/iai_benchmark/