chore(ci): Pin GitHub Actions to commit SHAs#16868
Merged
Merged
chore(ci): Pin GitHub Actions to commit SHAs#16868
Conversation
Pin all third-party actions to immutable commit SHAs, with the resolved version tag in a trailing comment. This prevents upstream tags from silently changing under us. - actions/checkout → v6.0.2 - actions/upload-artifact → v6.0.0 - EmbarkStudios/cargo-deny-action → v2.0.15 - taiki-e/install-action → v2.75.4 - crate-ci/typos → v1.44.0 `taiki-e/install-action` was previously referenced via the `@cargo-hack` tool-specific tag, which is force-updated on every release. Pinning it requires switching to the versioned `v2.75.4` tag and passing `tool: cargo-hack` explicitly, since the versioned action.yml does not default the tool input. See https://docs.zizmor.sh/audits/#unpinned-uses
Collaborator
|
r? @ehuss rustbot has assigned @ehuss. Use Why was this reviewer chosen?The reviewer was selected based on:
|
weihanglo
approved these changes
Apr 10, 2026
Member
There was a problem hiding this comment.
Thanks! I didn't know Renovate support it
doc for prosperity: https://docs.renovatebot.com/modules/manager/github-actions/#digest-pinning-and-updating
Member
Author
|
yeah, dependabot too AFAIK (see https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/keeping-your-actions-up-to-date-with-dependabot), but admittedly I don't have first-hand experience with that one |
rust-bors Bot
pushed a commit
to rust-lang/rust
that referenced
this pull request
Apr 18, 2026
Update cargo submodule 26 commits in eb94155a9a60943bd7b1cb04abec42f5d0de6ddc..3bf1388b8823ec4eab622340036593381d8871aa 2026-04-09 13:10:20 +0000 to 2026-04-17 23:27:26 +0000 - Add global HTTP timeout tracking to http_async (rust-lang/cargo#16903) - feat(config): Stabilize `resolver.lockfile-path` config (rust-lang/cargo#16694) - chore(deps): update msrv (1 version) to v1.95 (rust-lang/cargo#16897) - fix: rebuild rustdoc json for different versions of a same crate (rust-lang/cargo#16773) - Add effective_url to http_async (rust-lang/cargo#16899) - Make crate downloads process as a queue rather than a stack (rust-lang/cargo#16898) - fix: sparse registry fetch progress reporting (rust-lang/cargo#16900) - chore: bump to 0.98.0; update changelog (rust-lang/cargo#16892) - docs(semver-check): update diagnostics to Rust 1.95 (rust-lang/cargo#16895) - docs(ref): Better highlight 'package --list' for include/exclude (rust-lang/cargo#16891) - docs: `include` doesnt apply gitignore from repo (rust-lang/cargo#16890) - fix: Update `bash` and `zsh` Autocompletion Documents to add `-m` (rust-lang/cargo#16888) - Add `-m` shorthand for `--manifest-path` (rust-lang/cargo#16858) - Fix a typo (rust-lang/cargo#16885) - Always take a shared lock on `.cargo-lock` (rust-lang/cargo#16886) - fix(toml): Teach users how to pin edition (rust-lang/cargo#16851) - fix: Prefer defined lint levels over default (rust-lang/cargo#16879) - chore(deps): bump rand from 0.10.0 to 0.10.1 (rust-lang/cargo#16883) - fix(lints): Ignore unused_crate_dependencies status (rust-lang/cargo#16877) - Copy cargo clean target-dir validation tests to clean_new_layout.rs (rust-lang/cargo#16878) - cargo clean: Add target directory validation (rust-lang/cargo#16712) - Docs: "api" in the configuration should not include a trailing slash (rust-lang/cargo#16869) - fix(core): use `closest_msg` to suggest similar member name for mistyped `-p` (rust-lang/cargo#16844) - chore(ci): Pin GitHub Actions to commit SHAs (rust-lang/cargo#16868) - chore(ci): Update `actions/checkout` from v5 to v6 (rust-lang/cargo#16867) - Add test for cargo install with github fastpath (rust-lang/cargo#16866) r? ghost
rust-bors Bot
pushed a commit
to rust-lang/rust
that referenced
this pull request
Apr 18, 2026
Update cargo submodule 28 commits in eb94155a9a60943bd7b1cb04abec42f5d0de6ddc..7ecf0285ebb408d596e4a8ac76a0980d8edb7005 2026-04-09 13:10:20 +0000 to 2026-04-18 15:34:11 +0000 - fix: use `portable-atomic` for 64-bit atomics (rust-lang/cargo#16906) - fix: rename incorrectly documented target-spec-json to json-target-sp… (rust-lang/cargo#16905) - Add global HTTP timeout tracking to http_async (rust-lang/cargo#16903) - feat(config): Stabilize `resolver.lockfile-path` config (rust-lang/cargo#16694) - chore(deps): update msrv (1 version) to v1.95 (rust-lang/cargo#16897) - fix: rebuild rustdoc json for different versions of a same crate (rust-lang/cargo#16773) - Add effective_url to http_async (rust-lang/cargo#16899) - Make crate downloads process as a queue rather than a stack (rust-lang/cargo#16898) - fix: sparse registry fetch progress reporting (rust-lang/cargo#16900) - chore: bump to 0.98.0; update changelog (rust-lang/cargo#16892) - docs(semver-check): update diagnostics to Rust 1.95 (rust-lang/cargo#16895) - docs(ref): Better highlight 'package --list' for include/exclude (rust-lang/cargo#16891) - docs: `include` doesnt apply gitignore from repo (rust-lang/cargo#16890) - fix: Update `bash` and `zsh` Autocompletion Documents to add `-m` (rust-lang/cargo#16888) - Add `-m` shorthand for `--manifest-path` (rust-lang/cargo#16858) - Fix a typo (rust-lang/cargo#16885) - Always take a shared lock on `.cargo-lock` (rust-lang/cargo#16886) - fix(toml): Teach users how to pin edition (rust-lang/cargo#16851) - fix: Prefer defined lint levels over default (rust-lang/cargo#16879) - chore(deps): bump rand from 0.10.0 to 0.10.1 (rust-lang/cargo#16883) - fix(lints): Ignore unused_crate_dependencies status (rust-lang/cargo#16877) - Copy cargo clean target-dir validation tests to clean_new_layout.rs (rust-lang/cargo#16878) - cargo clean: Add target directory validation (rust-lang/cargo#16712) - Docs: "api" in the configuration should not include a trailing slash (rust-lang/cargo#16869) - fix(core): use `closest_msg` to suggest similar member name for mistyped `-p` (rust-lang/cargo#16844) - chore(ci): Pin GitHub Actions to commit SHAs (rust-lang/cargo#16868) - chore(ci): Update `actions/checkout` from v5 to v6 (rust-lang/cargo#16867) - Add test for cargo install with github fastpath (rust-lang/cargo#16866)
rust-bors Bot
pushed a commit
to rust-lang/rust
that referenced
this pull request
Apr 19, 2026
Update cargo submodule 28 commits in eb94155a9a60943bd7b1cb04abec42f5d0de6ddc..7ecf0285ebb408d596e4a8ac76a0980d8edb7005 2026-04-09 13:10:20 +0000 to 2026-04-18 15:34:11 +0000 - fix: use `portable-atomic` for 64-bit atomics (rust-lang/cargo#16906) - fix: rename incorrectly documented target-spec-json to json-target-sp… (rust-lang/cargo#16905) - Add global HTTP timeout tracking to http_async (rust-lang/cargo#16903) - feat(config): Stabilize `resolver.lockfile-path` config (rust-lang/cargo#16694) - chore(deps): update msrv (1 version) to v1.95 (rust-lang/cargo#16897) - fix: rebuild rustdoc json for different versions of a same crate (rust-lang/cargo#16773) - Add effective_url to http_async (rust-lang/cargo#16899) - Make crate downloads process as a queue rather than a stack (rust-lang/cargo#16898) - fix: sparse registry fetch progress reporting (rust-lang/cargo#16900) - chore: bump to 0.98.0; update changelog (rust-lang/cargo#16892) - docs(semver-check): update diagnostics to Rust 1.95 (rust-lang/cargo#16895) - docs(ref): Better highlight 'package --list' for include/exclude (rust-lang/cargo#16891) - docs: `include` doesnt apply gitignore from repo (rust-lang/cargo#16890) - fix: Update `bash` and `zsh` Autocompletion Documents to add `-m` (rust-lang/cargo#16888) - Add `-m` shorthand for `--manifest-path` (rust-lang/cargo#16858) - Fix a typo (rust-lang/cargo#16885) - Always take a shared lock on `.cargo-lock` (rust-lang/cargo#16886) - fix(toml): Teach users how to pin edition (rust-lang/cargo#16851) - fix: Prefer defined lint levels over default (rust-lang/cargo#16879) - chore(deps): bump rand from 0.10.0 to 0.10.1 (rust-lang/cargo#16883) - fix(lints): Ignore unused_crate_dependencies status (rust-lang/cargo#16877) - Copy cargo clean target-dir validation tests to clean_new_layout.rs (rust-lang/cargo#16878) - cargo clean: Add target directory validation (rust-lang/cargo#16712) - Docs: "api" in the configuration should not include a trailing slash (rust-lang/cargo#16869) - fix(core): use `closest_msg` to suggest similar member name for mistyped `-p` (rust-lang/cargo#16844) - chore(ci): Pin GitHub Actions to commit SHAs (rust-lang/cargo#16868) - chore(ci): Update `actions/checkout` from v5 to v6 (rust-lang/cargo#16867) - Add test for cargo install with github fastpath (rust-lang/cargo#16866)
github-actions Bot
pushed a commit
to rust-lang/stdarch
that referenced
this pull request
Apr 20, 2026
Update cargo submodule 28 commits in eb94155a9a60943bd7b1cb04abec42f5d0de6ddc..7ecf0285ebb408d596e4a8ac76a0980d8edb7005 2026-04-09 13:10:20 +0000 to 2026-04-18 15:34:11 +0000 - fix: use `portable-atomic` for 64-bit atomics (rust-lang/cargo#16906) - fix: rename incorrectly documented target-spec-json to json-target-sp… (rust-lang/cargo#16905) - Add global HTTP timeout tracking to http_async (rust-lang/cargo#16903) - feat(config): Stabilize `resolver.lockfile-path` config (rust-lang/cargo#16694) - chore(deps): update msrv (1 version) to v1.95 (rust-lang/cargo#16897) - fix: rebuild rustdoc json for different versions of a same crate (rust-lang/cargo#16773) - Add effective_url to http_async (rust-lang/cargo#16899) - Make crate downloads process as a queue rather than a stack (rust-lang/cargo#16898) - fix: sparse registry fetch progress reporting (rust-lang/cargo#16900) - chore: bump to 0.98.0; update changelog (rust-lang/cargo#16892) - docs(semver-check): update diagnostics to Rust 1.95 (rust-lang/cargo#16895) - docs(ref): Better highlight 'package --list' for include/exclude (rust-lang/cargo#16891) - docs: `include` doesnt apply gitignore from repo (rust-lang/cargo#16890) - fix: Update `bash` and `zsh` Autocompletion Documents to add `-m` (rust-lang/cargo#16888) - Add `-m` shorthand for `--manifest-path` (rust-lang/cargo#16858) - Fix a typo (rust-lang/cargo#16885) - Always take a shared lock on `.cargo-lock` (rust-lang/cargo#16886) - fix(toml): Teach users how to pin edition (rust-lang/cargo#16851) - fix: Prefer defined lint levels over default (rust-lang/cargo#16879) - chore(deps): bump rand from 0.10.0 to 0.10.1 (rust-lang/cargo#16883) - fix(lints): Ignore unused_crate_dependencies status (rust-lang/cargo#16877) - Copy cargo clean target-dir validation tests to clean_new_layout.rs (rust-lang/cargo#16878) - cargo clean: Add target directory validation (rust-lang/cargo#16712) - Docs: "api" in the configuration should not include a trailing slash (rust-lang/cargo#16869) - fix(core): use `closest_msg` to suggest similar member name for mistyped `-p` (rust-lang/cargo#16844) - chore(ci): Pin GitHub Actions to commit SHAs (rust-lang/cargo#16868) - chore(ci): Update `actions/checkout` from v5 to v6 (rust-lang/cargo#16867) - Add test for cargo install with github fastpath (rust-lang/cargo#16866)
github-actions Bot
pushed a commit
to rust-lang/miri
that referenced
this pull request
Apr 20, 2026
Update cargo submodule 28 commits in eb94155a9a60943bd7b1cb04abec42f5d0de6ddc..7ecf0285ebb408d596e4a8ac76a0980d8edb7005 2026-04-09 13:10:20 +0000 to 2026-04-18 15:34:11 +0000 - fix: use `portable-atomic` for 64-bit atomics (rust-lang/cargo#16906) - fix: rename incorrectly documented target-spec-json to json-target-sp… (rust-lang/cargo#16905) - Add global HTTP timeout tracking to http_async (rust-lang/cargo#16903) - feat(config): Stabilize `resolver.lockfile-path` config (rust-lang/cargo#16694) - chore(deps): update msrv (1 version) to v1.95 (rust-lang/cargo#16897) - fix: rebuild rustdoc json for different versions of a same crate (rust-lang/cargo#16773) - Add effective_url to http_async (rust-lang/cargo#16899) - Make crate downloads process as a queue rather than a stack (rust-lang/cargo#16898) - fix: sparse registry fetch progress reporting (rust-lang/cargo#16900) - chore: bump to 0.98.0; update changelog (rust-lang/cargo#16892) - docs(semver-check): update diagnostics to Rust 1.95 (rust-lang/cargo#16895) - docs(ref): Better highlight 'package --list' for include/exclude (rust-lang/cargo#16891) - docs: `include` doesnt apply gitignore from repo (rust-lang/cargo#16890) - fix: Update `bash` and `zsh` Autocompletion Documents to add `-m` (rust-lang/cargo#16888) - Add `-m` shorthand for `--manifest-path` (rust-lang/cargo#16858) - Fix a typo (rust-lang/cargo#16885) - Always take a shared lock on `.cargo-lock` (rust-lang/cargo#16886) - fix(toml): Teach users how to pin edition (rust-lang/cargo#16851) - fix: Prefer defined lint levels over default (rust-lang/cargo#16879) - chore(deps): bump rand from 0.10.0 to 0.10.1 (rust-lang/cargo#16883) - fix(lints): Ignore unused_crate_dependencies status (rust-lang/cargo#16877) - Copy cargo clean target-dir validation tests to clean_new_layout.rs (rust-lang/cargo#16878) - cargo clean: Add target directory validation (rust-lang/cargo#16712) - Docs: "api" in the configuration should not include a trailing slash (rust-lang/cargo#16869) - fix(core): use `closest_msg` to suggest similar member name for mistyped `-p` (rust-lang/cargo#16844) - chore(ci): Pin GitHub Actions to commit SHAs (rust-lang/cargo#16868) - chore(ci): Update `actions/checkout` from v5 to v6 (rust-lang/cargo#16867) - Add test for cargo install with github fastpath (rust-lang/cargo#16866)
lnicola
pushed a commit
to lnicola/rust-analyzer
that referenced
this pull request
Apr 20, 2026
Update cargo submodule 28 commits in eb94155a9a60943bd7b1cb04abec42f5d0de6ddc..7ecf0285ebb408d596e4a8ac76a0980d8edb7005 2026-04-09 13:10:20 +0000 to 2026-04-18 15:34:11 +0000 - fix: use `portable-atomic` for 64-bit atomics (rust-lang/cargo#16906) - fix: rename incorrectly documented target-spec-json to json-target-sp… (rust-lang/cargo#16905) - Add global HTTP timeout tracking to http_async (rust-lang/cargo#16903) - feat(config): Stabilize `resolver.lockfile-path` config (rust-lang/cargo#16694) - chore(deps): update msrv (1 version) to v1.95 (rust-lang/cargo#16897) - fix: rebuild rustdoc json for different versions of a same crate (rust-lang/cargo#16773) - Add effective_url to http_async (rust-lang/cargo#16899) - Make crate downloads process as a queue rather than a stack (rust-lang/cargo#16898) - fix: sparse registry fetch progress reporting (rust-lang/cargo#16900) - chore: bump to 0.98.0; update changelog (rust-lang/cargo#16892) - docs(semver-check): update diagnostics to Rust 1.95 (rust-lang/cargo#16895) - docs(ref): Better highlight 'package --list' for include/exclude (rust-lang/cargo#16891) - docs: `include` doesnt apply gitignore from repo (rust-lang/cargo#16890) - fix: Update `bash` and `zsh` Autocompletion Documents to add `-m` (rust-lang/cargo#16888) - Add `-m` shorthand for `--manifest-path` (rust-lang/cargo#16858) - Fix a typo (rust-lang/cargo#16885) - Always take a shared lock on `.cargo-lock` (rust-lang/cargo#16886) - fix(toml): Teach users how to pin edition (rust-lang/cargo#16851) - fix: Prefer defined lint levels over default (rust-lang/cargo#16879) - chore(deps): bump rand from 0.10.0 to 0.10.1 (rust-lang/cargo#16883) - fix(lints): Ignore unused_crate_dependencies status (rust-lang/cargo#16877) - Copy cargo clean target-dir validation tests to clean_new_layout.rs (rust-lang/cargo#16878) - cargo clean: Add target directory validation (rust-lang/cargo#16712) - Docs: "api" in the configuration should not include a trailing slash (rust-lang/cargo#16869) - fix(core): use `closest_msg` to suggest similar member name for mistyped `-p` (rust-lang/cargo#16844) - chore(ci): Pin GitHub Actions to commit SHAs (rust-lang/cargo#16868) - chore(ci): Update `actions/checkout` from v5 to v6 (rust-lang/cargo#16867) - Add test for cargo install with github fastpath (rust-lang/cargo#16866)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin all third-party actions to immutable commit SHAs, with the resolved version tag in a trailing comment. This prevents upstream tags from silently changing under us.
taiki-e/install-actionwas previously referenced via the@cargo-hacktool-specific tag, which is force-updated on every release. Pinning it requires switching to the versionedv2.75.4tag and passingtool: cargo-hackexplicitly, since the versioned action.yml does not default the tool input.See https://docs.zizmor.sh/audits/#unpinned-uses (and #16867 (comment))