From dec9c90a01ca222637a523b64a5a78623818d3c9 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 19 Sep 2026 22:55:26 +0000
Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows
could not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`.

`dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an
explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel.

No behaviour is intended to change beyond the pins.
---
 .github/workflows/rhodibot.yml | 2 +-
 .github/workflows/rust-ci.yml  | 9 +++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index 29dc13e..255ddea 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -34,7 +34,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
       - name: Rhodibot — detect drift (no mutations)
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 14b9590..e841bb1 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -22,10 +22,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
         with:
+          toolchain: stable
           components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - name: cargo fmt
         run: cargo fmt --all -- --check
       - name: cargo clippy
@@ -43,10 +44,10 @@ jobs:
           - "stable"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dtolnay/rust-toolchain@master
+      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de  # master
         with:
           toolchain: ${{ matrix.rust }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
         with:
           key: ${{ matrix.rust }}
       - name: cargo test