ci: [StepSecurity] apply security best practices

.github/dependabot.yml

@@ -22,3 +22,23 @@ updates:
   directory: "/.github/actions/install-nix"
   schedule:
     interval: "daily"
+
+- package-ecosystem: gomod
+  directory: /examples/go/complex-server
+  schedule:
+    interval: daily
+
+- package-ecosystem: gomod
+  directory: /examples/go/hello-client
+  schedule:
+    interval: daily
+
+- package-ecosystem: gomod
+  directory: /examples/go/hello-server
+  schedule:
+    interval: daily
+
+- package-ecosystem: gomod
+  directory: /tests/go
+  schedule:
+    interval: daily

.github/workflows/nix.yml

@@ -13,7 +13,7 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/[email protected]
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
     - uses: ./.github/actions/install-nix
       with:
         cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -22,7 +22,7 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/[email protected]
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
     - uses: ./.github/actions/install-nix
       with:
         cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -32,7 +32,7 @@ jobs:
   develop:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/[email protected]
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
     - uses: ./.github/actions/install-nix
       with:
         cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

.github/workflows/update.yml

@@ -9,7 +9,7 @@ jobs:
   nix-flake-update:
     runs-on: ubuntu-latest
     steps:
-      - uses: rvolosatovs/nix-flake-update-action@v2
+      - uses: rvolosatovs/nix-flake-update-action@60ed905545151a290d73ce1302c23f4fb7ff43f0 # v2.0.4
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

.github/workflows/wrpc.yml

@@ -66,7 +66,7 @@ jobs:
     name: wrpc-${{ matrix.config.target }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - uses: ./.github/actions/install-nix
         with:
           cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -86,11 +86,11 @@ jobs:
     needs: build-bin
     runs-on: macos-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: wrpc-aarch64-apple-darwin
           path: aarch64
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: wrpc-x86_64-apple-darwin
           path: x86_64
@@ -104,7 +104,7 @@ jobs:
       - run: chmod +x ./artifact/bin/wit-bindgen-wrpc
       - run: ./artifact/bin/wit-bindgen-wrpc --version
 
-      - uses: actions/[email protected]
+      - uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
         with:
           name: wrpc-universal-darwin
           path: artifact
@@ -113,7 +113,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build-bin
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: wrpc-x86_64-unknown-linux-musl
       - run: chmod +x ./bin/wit-bindgen-wrpc
@@ -123,7 +123,7 @@ jobs:
     runs-on: windows-latest
     needs: build-bin
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: wrpc-x86_64-pc-windows-gnu
       - run: .\bin\wit-bindgen-wrpc.exe --version
@@ -140,7 +140,7 @@ jobs:
     name: cargo ${{ matrix.check }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - uses: ./.github/actions/install-nix
         with:
           cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -153,7 +153,7 @@ jobs:
   build-doc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - uses: ./.github/actions/install-nix
         with:
           cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -171,7 +171,7 @@ jobs:
             <meta http-equiv="refresh" content="0; URL=wrpc/index.html">
             <link rel="canonical" href="https://${{ github.repository_owner }}.github.io/wrpc/wrpc/index.html">
           EOF
-      - uses: actions/[email protected]
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: doc
 
@@ -186,7 +186,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
         id: deployment
 
   oci:
@@ -197,7 +197,7 @@ jobs:
       - build-bin
       - test-linux
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - uses: ./.github/actions/install-nix
         with:
           cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -218,7 +218,7 @@ jobs:
 
       - name: Login to GitHub Container Registry
         if: startswith(github.ref, format('refs/tags/{0}v', matrix.prefix)) || github.ref == 'refs/heads/main'
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -272,8 +272,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/[email protected]
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           path: artifacts
       - run: |
@@ -296,7 +296,7 @@ jobs:
             done
           done
 
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           draft: true
@@ -325,7 +325,7 @@ jobs:
     needs: cargo
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Extract tag context
         id: ctx