[epompeii]

Problem

Lint / Zizmor Online failed on #1251 (run https://github.com/bencherdev/bencher/actions/runs/38846843953, job https://github.com/bencherdev/bencher/actions/runs/38846843953/job/116799199507) with one medium finding, exit 13:

update_sandbox.yml:18: action's hash pin has mismatched or missing version comment: points to commit 683b588c487a

Line 18 is dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1, pinned by #1199. The upstream v1 tag moved to 683b588c487a69d01f6c6ddf40f036ff682cc2c8 on 2026-10-16. devel carries the same pin, so the job is red on every run since. The job is continue-on-error: true, so it does not block a merge.

Change

Repin update_sandbox.yml to the commit v1 points at today and keep the # v1 comment, as #1199 did. The hash was resolved from the GitHub refs API (v1 is a lightweight tag on that commit). No other workflow or composite action uses this action.

Upstream range

e2a55d2f...683b588c is one commit, "Add 1.99.1 patch release", which adds 1.99.1 to the patch release list in scripts/update-revs.sh. action.yml is unchanged, so this call site (toolchain: stable) runs exactly the same steps.

Other moving refs

Every other pin whose comment names a moving ref still matches it today: rui314/setup-mold@339e96b4 # v1 (14 sites), dawidd6/action-download-artifact@b6e2e706 # v21 (2 sites), and superfly/flyctl-actions/setup-flyctl@ed8efb33 # master (3 sites, the current master head). The online pass below proves it.

Verification

zizmor 1.25.2, the version CI pins, from the same digest-pinned image zizmor-action runs (ghcr.io/zizmorcore/zizmor:1.25.2@sha256:14ea7f5c...), with the action's arguments (--persona=regular --format=github, plus --no-online-audits for the offline job):

Tree	Offline	Online
devel	exit 0	exit 13, the one ref-version-mismatch finding above
this branch	exit 0	exit 0, no findings

CI on this pull request is the final check.