use sha references in Actions instead of tags

.github/workflows/CargoAudit.yml

@@ -13,14 +13,14 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # We are not using the common workflow here because it installs a bunch of tools we don't need.
       # TODO: Once the runner image is updated to include the necessary tools (without downloading), we can switch to the common workflow.
-      - uses: dtolnay/rust-toolchain@master
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
           toolchain: "1.89"
 
-      - uses: rustsec/audit-check@v2.0.0
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/CreateRelease.yml

@@ -35,7 +35,7 @@ jobs:
       dry_run: ${{ steps.set-version.outputs.dry_run }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -64,7 +64,7 @@ jobs:
     if: ${{ needs.set-version.outputs.dry_run == 'false' }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Create Release Branch
         shell: bash

.github/workflows/IssueLabelChecker.yml

@@ -11,7 +11,7 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
     - name: Check and Add label
       run: |
         # The cryptic head -c -1 is because otherwise gh always terminates output with a newline

.github/workflows/PRLabelChecker.yml

@@ -11,7 +11,7 @@ jobs:
   check-labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Ensure exactly one "kind/*" label is applied
         run: |
           # Count the number of "kind/*" labels directly from the PR labels

.github/workflows/ValidatePullRequests.yml

@@ -32,7 +32,7 @@ jobs:
     name: check license headers
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
     - name: Check License Headers
       run: ./dev/check-license-headers.sh
 
@@ -54,6 +54,6 @@ jobs:
     name: Spell check with typos
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
     - name: Spell Check Repo
-      uses: crate-ci/typos@v1.50.3
+      uses: crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3

.github/workflows/auto-merge-dependabot.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
 
       # Gets the GitHub App token
-      - uses: actions/create-github-app-token@v3
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         id: get-app-token
         with:
           # required
@@ -33,7 +33,7 @@ jobs:
           permission-actions: read
 
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ steps.get-app-token.outputs.token }}
           persist-credentials: false

.github/workflows/cargo-publish.yml

@@ -40,14 +40,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           fetch-tags: true
 
       # Ensures just is installed using setup wokflow to ensure just version consistency
       - name: Hyperlight setup
-        uses: hyperlight-dev/ci-setup-workflow@v1.10.0
+        uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3 # v1.10.0
         with:
           rust-toolchain: "1.90"
           just-version: "1.51"
@@ -101,7 +101,7 @@ jobs:
                     -p hyperlight-js-runtime
 
       - name: Authenticate with crates.io
-        uses: rust-lang/crates-io-auth-action@v1
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1
         id: crates-io-auth
 
       - name: Publish hyperlight-js-common

.github/workflows/dep_benchmarks.yml

@@ -50,11 +50,11 @@ jobs:
         github.run_attempt)) }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3 # v1.10.0
         with:
           rust-toolchain: "1.90"
           just-version: "1.51"
@@ -86,7 +86,7 @@ jobs:
         working-directory: ./src/hyperlight-js 
 
       - name: Upload benchmarks
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: benchmarks_${{runner.os}}_${{matrix.hypervisor}}
           path: ./target/criterion/

.github/workflows/dep_build.yml

@@ -85,11 +85,11 @@ jobs:
         github.run_attempt)) }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
         fetch-depth: 0
 
-    - uses: hyperlight-dev/ci-setup-workflow@v1.10.0
+    - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3 # v1.10.0
       with:
           rust-toolchain: "1.90"
           just-version: "1.51"
@@ -134,7 +134,7 @@ jobs:
         fi
 
     - name: install nodejs
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
       with:
         node-version: '22'
         cache: 'npm'

.github/workflows/gh-publish.yml

@@ -35,25 +35,25 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Download benchmarks (Windows)
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: benchmarks_Windows_whp
           path: benchmarks_Windows_whp
 
       - name: Download benchmarks (Linux kvm)
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: benchmarks_Linux_kvm
           path: benchmarks_Linux_kvm
 
       - name: Download benchmarks (Linux hyperv3)
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: benchmarks_Linux_hyperv3
           path: benchmarks_Linux_hyperv3

.github/workflows/npm-publish.yml

@@ -72,18 +72,18 @@ jobs:
             build_name: linux-arm64-gnu
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
       - name: Hyperlight setup
-        uses: hyperlight-dev/ci-setup-workflow@v1.10.0
+        uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3 # v1.10.0
         with:
           rust-toolchain: "1.90"
           just-version: "1.51"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -144,7 +144,7 @@ jobs:
         run: npm run build -- --target ${{ matrix.target }}
 
       - name: Upload native binary
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bindings-${{ matrix.build_name }}
           path: ${{ env.WORKING_DIR }}/*.node
@@ -154,7 +154,7 @@ jobs:
       # platform-independent, so we only need to upload them once.
       - name: Upload JS bindings
         if: matrix.build_name == 'linux-x64-gnu'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: js-bindings
           path: |
@@ -166,10 +166,10 @@ jobs:
     needs: build
     runs-on: [self-hosted, Linux, arm64, kvm]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '22.22.3'
           cache: 'npm'
@@ -181,13 +181,13 @@ jobs:
           test "$(node -p process.arch)" = "arm64"
 
       - name: Download Linux arm64 GNU artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: bindings-linux-arm64-gnu
           path: ${{ env.WORKING_DIR }}/artifacts/linux-arm64-gnu
 
       - name: Download JS bindings
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: js-bindings
           path: ${{ env.WORKING_DIR }}/js-bindings
@@ -233,7 +233,7 @@ jobs:
     # so it does not need self-hosted runners with KVM/Hyperlight.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Enable KVM
         run: |
@@ -244,7 +244,7 @@ jobs:
           sudo chmod a+rwx /dev/kvm
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           # node 22.22.2 has an issue where we can't upgrade npm to 11.x
           # see https://github.com/nodejs/node/issues/62425
@@ -267,37 +267,37 @@ jobs:
         run: npm ci --ignore-scripts --omit=optional
 
       - name: Download Linux GNU artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: bindings-linux-x64-gnu
           path: ${{ env.WORKING_DIR }}/artifacts/linux-x64-gnu
 
       - name: Download Linux musl artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: bindings-linux-x64-musl
           path: ${{ env.WORKING_DIR }}/artifacts/linux-x64-musl
 
       - name: Download Windows artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: bindings-win32-x64-msvc
           path: ${{ env.WORKING_DIR }}/artifacts/win32-x64-msvc
 
       - name: Download macOS arm64 artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: bindings-darwin-arm64
           path: ${{ env.WORKING_DIR }}/artifacts/darwin-arm64
 
       - name: Download Linux arm64 GNU artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: bindings-linux-arm64-gnu
           path: ${{ env.WORKING_DIR }}/artifacts/linux-arm64-gnu
 
       - name: Download JS bindings
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: js-bindings
           path: ${{ env.WORKING_DIR }}/js-bindings