Backport workflow-hardening fix (unpinned-uses) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/build.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

• 410c561

Affected release branches (5)

• 1.23.x (still present as of HEAD 74970be4)
• 1.21.x (still present as of HEAD 82691b51)
• 1.18.x (still present as of HEAD 7452c37e)
• 1.19.x (still present as of HEAD 64049ba8)
• 1.20.x (still present as of HEAD a3e8bda1)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

1.23.x — unpinned-uses

File .github/workflows/build.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,7 +56,7 @@
           delay=$((1 + $RANDOM % 32))
           echo "Waiting ${delay} seconds before execution"
           sleep $delay
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
       - name: Preflight step to set up the runner
         uses: ./.github/actions/setup-node
       - run: rustup component add rustfmt

1.21.x — unpinned-uses

File .github/workflows/build.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,7 +56,7 @@
           delay=$((1 + $RANDOM % 32))
           echo "Waiting ${delay} seconds before execution"
           sleep $delay
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
       - name: Preflight step to set up the runner
         uses: ./.github/actions/setup-node
       - run: rustup component add rustfmt

1.18.x — unpinned-uses

File .github/workflows/build.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,7 +58,7 @@
           delay=$((1 + $RANDOM % 32))
           echo "Waiting ${delay} seconds before execution"
           sleep $delay
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
       - name: Preflight step to set up the runner
         uses: ./.github/actions/setup-node
       - if: contains(matrix.variant, 'nvidia')

1.19.x — unpinned-uses

File .github/workflows/build.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,7 +58,7 @@
           delay=$((1 + $RANDOM % 32))
           echo "Waiting ${delay} seconds before execution"
           sleep $delay
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
       - name: Preflight step to set up the runner
         uses: ./.github/actions/setup-node
       - if: contains(matrix.variant, 'nvidia')

1.20.x — unpinned-uses

File .github/workflows/build.yml; suggested edits:

• ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,7 +58,7 @@
           delay=$((1 + $RANDOM % 32))
           echo "Waiting ${delay} seconds before execution"
           sleep $delay
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
       - name: Preflight step to set up the runner
         uses: ./.github/actions/setup-node
       - if: contains(matrix.variant, 'nvidia')

---

Happy to open pull requests instead if that's preferred.

[piyush-jena]

@CharlieMCY Thanks for the issue but we don't maintain our old release branches.