Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -36,3 +36,5 @@ updates:
         update-types:
           - "minor"
           - "patch"
+    cooldown:
+      default-days: 7

.github/workflows/benchmark.yml

@@ -28,18 +28,20 @@ jobs:
       deployments: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v2
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
 
       - name: Run benchmark
         # We use --output-format bencher to make the output compatible with the
         # github-action-benchmark action's 'cargo' tool parser.
+        env:
+          CRITERION_HOME: ${{ runner.temp }}/criterion
         run: cargo bench --bench bench_main --all-features -- --output-format bencher | tee output.txt
 
       - name: Store benchmark result
-        uses: benchmark-action/github-action-benchmark@v1
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
         with:
           name: RulesXP Benchmark
           tool: 'cargo'

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Resolve toolchain
       id: resolve
@@ -59,7 +59,7 @@ jobs:
         fi
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: ${{ steps.resolve.outputs.toolchain }}
         components: ${{ steps.resolve.outputs.should-run-full-checks == 'true' && 'clippy' || '' }}
@@ -87,15 +87,15 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         components: llvm-tools-preview
 
     - name: Install cargo-llvm-cov
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
       with:
         tool: cargo-llvm-cov
 
@@ -105,15 +105,15 @@ jobs:
         cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info --no-run
 
     - name: Upload coverage HTML
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coverage-report
         path: coverage-html/
         retention-days: 30
 
     - name: Upload to Codecov
       if: env.CODECOV_TOKEN != ''
-      uses: codecov/codecov-action@v7
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         files: lcov.info
         fail_ci_if_error: true
@@ -127,10 +127,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         components: rustfmt
 
@@ -146,10 +146,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
 
     - name: Build documentation
       run: cargo doc --all-features --no-deps
@@ -163,10 +163,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust nightly
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: nightly
 
@@ -183,10 +183,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install cargo-audit
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
       with:
         tool: cargo-audit
 
@@ -200,15 +200,15 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust nightly
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: nightly
 
     - name: Install cargo-hack and cargo-minimal-versions
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
       with:
         tool: cargo-hack,cargo-minimal-versions
 
@@ -222,10 +222,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install typos
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
       with:
         tool: typos-cli
 
@@ -239,10 +239,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Run actionlint
-      uses: raven-actions/actionlint@v2
+      uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
 
   ci-success:
     name: CI Success

.github/workflows/cross-platform.yml

@@ -32,10 +32,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
 
     - name: Run tests
       run: cargo test --all-features --verbose

.github/workflows/fuzz.yml

@@ -31,14 +31,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ['eval_sexpr', 'eval_jsonlogic']
+        target: ['eval-sexpr', 'eval-jsonlogic']
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust nightly
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: nightly
 
@@ -50,7 +50,7 @@ jobs:
     # - Restore key uses prefix match to find the most recent cache from any prior run
     # - Daily runs ensure we always have a recent corpus to build on
     - name: Restore corpus cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: fuzz/corpus/${{ matrix.target }}
         key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
@@ -75,22 +75,22 @@ jobs:
 
     - name: Upload crash artifacts
       if: steps.check_crashes.outputs.crashes_found == 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: fuzz-crashes-${{ matrix.target }}
         path: fuzz/artifacts/${{ matrix.target }}/
 
     - name: Upload corpus
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: fuzz-corpus-${{ matrix.target }}
         path: fuzz/corpus/${{ matrix.target }}/
         retention-days: 7
 
     - name: Create issue for crashes
       if: steps.check_crashes.outputs.crashes_found == 'true'
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const fs = require('fs');

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         # The ancestry check needs enough history to prove the tag commit
         # is reachable from origin/main.
@@ -40,7 +40,7 @@ jobs:
         fi
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: stable
         rustflags: ''
@@ -58,7 +58,7 @@ jobs:
         echo "Version check passed: $CARGO_VERSION"
 
     - name: Authenticate with crates.io
-      uses: rust-lang/crates-io-auth-action@v1
+      uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
       id: auth
 
     - name: Publish to crates.io
@@ -80,7 +80,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Get tag name
       id: tag_name
@@ -120,10 +120,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: stable
         target: ${{ matrix.target }}

CHANGELOG.md

@@ -10,7 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - CI enforces production-code-only MSRV, stricter doc and workflow checks, least-privilege permissions & job timeouts
-- Release flow uses SHA-pinning-friendly Rust installation, locked publication, pre-publish tag validation, and retry-safe GH releases
+- CI uses SHA-pinned actions, locked publication, pre-publish tag validation, and retry-safe GH releases
 
 ## 0.3.1
 

fuzz/Cargo.toml

@@ -14,14 +14,14 @@ path = ".."
 features = ["scheme", "jsonlogic"]
 
 [[bin]]
-name = "eval_sexpr"
+name = "eval-sexpr"
 path = "fuzz_targets/eval_sexpr.rs"
 test = false
 doc = false
 bench = false
 
 [[bin]]
-name = "eval_jsonlogic"
+name = "eval-jsonlogic"
 path = "fuzz_targets/eval_jsonlogic.rs"
 test = false
 doc = false