From 5d64563e797459d5702c4b1720e4e9c57d1b7b3e Mon Sep 17 00:00:00 2001
From: Resham Joshi <65915470+iamtoruk@users.noreply.github.com>
Date: Tue, 20 Oct 2026 10:54:52 -0700
Subject: [PATCH 1/2] ci: gate signing jobs behind a release environment and
 pin actions to commits

---
 .github/workflows/block-claude-coauthor.yml   |  2 +-
 .github/workflows/build-desktop-mac.yml       |  7 ++++---
 .github/workflows/build-snap.yml              | 19 ++++++++++++++-----
 .github/workflows/build-windows-installer.yml | 14 +++++++-------
 .github/workflows/build-windows-store.yml     | 10 +++++-----
 .github/workflows/ci.yml                      |  2 +-
 .github/workflows/mac-menubar-ci.yml          |  2 +-
 .github/workflows/pr-limit.yml                |  2 +-
 .github/workflows/release-menubar-windows.yml | 13 +++++++------
 .github/workflows/release-menubar.yml         |  7 ++++---
 .github/workflows/tests.yml                   | 18 +++++++++---------
 .github/workflows/upgrade-path.yml            |  6 +++---
 .github/workflows/windows-menubar-ci.yml      |  8 ++++----
 13 files changed, 61 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/block-claude-coauthor.yml b/.github/workflows/block-claude-coauthor.yml
index 97db0a109..f481e838c 100644
--- a/.github/workflows/block-claude-coauthor.yml
+++ b/.github/workflows/block-claude-coauthor.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/build-desktop-mac.yml b/.github/workflows/build-desktop-mac.yml
index 07df36e3a..741f7562c 100644
--- a/.github/workflows/build-desktop-mac.yml
+++ b/.github/workflows/build-desktop-mac.yml
@@ -15,11 +15,12 @@ permissions:
 jobs:
   mac:
     runs-on: macos-latest
+    environment: release
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22.13.0
           cache: npm
@@ -119,7 +120,7 @@ jobs:
           security delete-keychain "$RUNNER_TEMP/codeburn-signing.keychain-db" 2>/dev/null || true
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: CodeBurn-macOS
           path: |
diff --git a/.github/workflows/build-snap.yml b/.github/workflows/build-snap.yml
index 11fac2d8f..6dc8d0c28 100644
--- a/.github/workflows/build-snap.yml
+++ b/.github/workflows/build-snap.yml
@@ -22,9 +22,9 @@ jobs:
   snap:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22.13.0
           cache: npm
@@ -42,20 +42,29 @@ jobs:
         run: npm --prefix app run package:snap
 
       - name: Upload snap artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: CodeBurn-Snap
           path: app/release/codeburn_*.snap
           if-no-files-found: error
           retention-days: 14
 
+  publish:
+    needs: snap
+    if: github.event_name == 'workflow_dispatch' && inputs.publish
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          name: CodeBurn-Snap
+
       - name: Publish to Snap Store
-        if: github.event_name == 'workflow_dispatch' && inputs.publish
         env:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
         run: |
           sudo snap install snapcraft --classic
           # snapcraft exits 1 when the store queues the revision for manual review,
           # which every personal-files snap does; the upload itself succeeded.
-          snapcraft upload --release=stable app/release/codeburn_*.snap 2>&1 | tee upload.log
+          snapcraft upload --release=stable codeburn_*.snap 2>&1 | tee upload.log
           test "${PIPESTATUS[0]}" -eq 0 || grep -q 'will need manual review' upload.log
diff --git a/.github/workflows/build-windows-installer.yml b/.github/workflows/build-windows-installer.yml
index 0547f8be3..f6f05e092 100644
--- a/.github/workflows/build-windows-installer.yml
+++ b/.github/workflows/build-windows-installer.yml
@@ -31,9 +31,9 @@ jobs:
     if: ${{ github.event_name != 'release' && !(github.event_name == 'workflow_dispatch' && inputs.release_tag != '') }}
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22.13.0
           cache: npm
@@ -53,11 +53,11 @@ jobs:
 
       # The installer ships the tray app: stage-menubar.mjs takes the MSI that
       # `tauri build` leaves in windows/src-tauri/target/release/bundle/msi.
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: x86_64-pc-windows-msvc
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: windows/src-tauri
 
@@ -84,7 +84,7 @@ jobs:
           }
 
       - name: Upload installer artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: CodeBurn-Windows-Installer
           path: |
@@ -98,7 +98,7 @@ jobs:
     if: ${{ (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'desktop-v')) || (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Verify live desktop release assets
         env:
@@ -119,7 +119,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Publish desktop update feeds
         env:
diff --git a/.github/workflows/build-windows-store.yml b/.github/workflows/build-windows-store.yml
index df29c05a3..95b3de27f 100644
--- a/.github/workflows/build-windows-store.yml
+++ b/.github/workflows/build-windows-store.yml
@@ -24,9 +24,9 @@ jobs:
   appx:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22.13.0
           cache: npm
@@ -43,11 +43,11 @@ jobs:
 
       # The Store package ships the tray exe: stage-menubar.mjs takes it from
       # windows/src-tauri/target/release, so no MSI bundle is needed here.
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: x86_64-pc-windows-msvc
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: windows/src-tauri
 
@@ -64,7 +64,7 @@ jobs:
         run: npm --prefix app run package:store
 
       - name: Upload Store package
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: CodeBurn-Microsoft-Store
           path: app/release/CodeBurn-Store-*.appx
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1230adca9..9cf4aad30 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ jobs:
   semgrep:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Install Semgrep
         run: pip install semgrep
diff --git a/.github/workflows/mac-menubar-ci.yml b/.github/workflows/mac-menubar-ci.yml
index f7d9cc1ca..a8ae8af0e 100644
--- a/.github/workflows/mac-menubar-ci.yml
+++ b/.github/workflows/mac-menubar-ci.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Swift toolchain
         run: swift --version
       - name: Build
diff --git a/.github/workflows/pr-limit.yml b/.github/workflows/pr-limit.yml
index 03980d155..9892f622b 100644
--- a/.github/workflows/pr-limit.yml
+++ b/.github/workflows/pr-limit.yml
@@ -21,7 +21,7 @@ jobs:
   gate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const maxOpen = 5
diff --git a/.github/workflows/release-menubar-windows.yml b/.github/workflows/release-menubar-windows.yml
index 1e7bc4642..82d927728 100644
--- a/.github/workflows/release-menubar-windows.yml
+++ b/.github/workflows/release-menubar-windows.yml
@@ -22,10 +22,11 @@ permissions:
 jobs:
   build:
     runs-on: windows-latest
+    environment: release
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Resolve version label
         id: version
@@ -37,17 +38,17 @@ jobs:
             echo "value=${{ github.event.inputs.version }}" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22.13.0
           cache: npm
           cache-dependency-path: windows/package-lock.json
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: x86_64-pc-windows-msvc
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: windows/src-tauri
 
@@ -82,7 +83,7 @@ jobs:
 
       - name: Upload artifact (for manual runs)
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: CodeBurnMenubar-Windows-${{ steps.version.outputs.value }}
           path: release-artifacts/*
@@ -90,7 +91,7 @@ jobs:
 
       - name: Create / update GitHub Release
         if: startsWith(github.ref, 'refs/tags/windows-v')
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ github.ref_name }}
           name: Windows Menubar ${{ steps.version.outputs.value }}
diff --git a/.github/workflows/release-menubar.yml b/.github/workflows/release-menubar.yml
index 59153f110..d31d32aee 100644
--- a/.github/workflows/release-menubar.yml
+++ b/.github/workflows/release-menubar.yml
@@ -24,9 +24,10 @@ permissions:
 jobs:
   build:
     runs-on: macos-latest
+    environment: release
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Resolve version label
         id: version
@@ -112,7 +113,7 @@ jobs:
 
       - name: Upload artifact (for manual runs)
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: CodeBurnMenubar-${{ steps.version.outputs.value }}
           path: |
@@ -122,7 +123,7 @@ jobs:
 
       - name: Create / update GitHub Release
         if: startsWith(github.ref, 'refs/tags/mac-v')
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ github.ref_name }}
           name: Menubar ${{ steps.version.outputs.value }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index cc5413fd5..3535c4527 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -18,8 +18,8 @@ jobs:
         node-version: [22.13.0, 22, 24, 26]
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -71,8 +71,8 @@ jobs:
         os: [macos-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -94,8 +94,8 @@ jobs:
         working-directory: app
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22.13.0
           cache: npm
@@ -116,8 +116,8 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22.13.0
           cache: npm
@@ -149,7 +149,7 @@ jobs:
       - name: Smoke test in VS Code
         run: xvfb-run -a npm run test:smoke
         working-directory: vscode
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: codeburn-vscode
           path: vscode/*.vsix
diff --git a/.github/workflows/upgrade-path.yml b/.github/workflows/upgrade-path.yml
index 4791d6a80..f46231b3d 100644
--- a/.github/workflows/upgrade-path.yml
+++ b/.github/workflows/upgrade-path.yml
@@ -27,8 +27,8 @@ jobs:
         node-version: [22.13.0, 22]
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -46,7 +46,7 @@ jobs:
 
       - name: Upload payloads on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: upgrade-path-${{ matrix.os }}-node${{ matrix.node-version }}
           path: ${{ runner.temp }}/codeburn upgrade path/payloads
diff --git a/.github/workflows/windows-menubar-ci.yml b/.github/workflows/windows-menubar-ci.yml
index 85ade9eff..27a2ae4f8 100644
--- a/.github/workflows/windows-menubar-ci.yml
+++ b/.github/workflows/windows-menubar-ci.yml
@@ -28,7 +28,7 @@ jobs:
         os: [windows-latest, ubuntu-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       # webkit2gtk + libayatana are what the Tauri and ksni crates link against; without
       # them the Linux leg cannot even typecheck the Rust side.
@@ -45,17 +45,17 @@ jobs:
             libgtk-3-dev \
             build-essential
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22.13.0
           cache: npm
           cache-dependency-path: windows/package-lock.json
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: clippy
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: windows/src-tauri
 

From 5187032347b3de8ab7a55dc017983545a50f90a7 Mon Sep 17 00:00:00 2001
From: Resham Joshi <65915470+iamtoruk@users.noreply.github.com>
Date: Tue, 20 Oct 2026 10:57:13 -0700
Subject: [PATCH 2/2] ci: name the Rust toolchain explicitly now that the
 action is pinned

---
 .github/workflows/build-windows-installer.yml | 1 +
 .github/workflows/build-windows-store.yml     | 1 +
 .github/workflows/release-menubar-windows.yml | 1 +
 .github/workflows/windows-menubar-ci.yml      | 1 +
 4 files changed, 4 insertions(+)

diff --git a/.github/workflows/build-windows-installer.yml b/.github/workflows/build-windows-installer.yml
index f6f05e092..5d415aa30 100644
--- a/.github/workflows/build-windows-installer.yml
+++ b/.github/workflows/build-windows-installer.yml
@@ -55,6 +55,7 @@ jobs:
       # `tauri build` leaves in windows/src-tauri/target/release/bundle/msi.
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
+          toolchain: stable
           targets: x86_64-pc-windows-msvc
 
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
diff --git a/.github/workflows/build-windows-store.yml b/.github/workflows/build-windows-store.yml
index 95b3de27f..fe35a45ba 100644
--- a/.github/workflows/build-windows-store.yml
+++ b/.github/workflows/build-windows-store.yml
@@ -45,6 +45,7 @@ jobs:
       # windows/src-tauri/target/release, so no MSI bundle is needed here.
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
+          toolchain: stable
           targets: x86_64-pc-windows-msvc
 
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
diff --git a/.github/workflows/release-menubar-windows.yml b/.github/workflows/release-menubar-windows.yml
index 82d927728..893be5fc8 100644
--- a/.github/workflows/release-menubar-windows.yml
+++ b/.github/workflows/release-menubar-windows.yml
@@ -46,6 +46,7 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
+          toolchain: stable
           targets: x86_64-pc-windows-msvc
 
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
diff --git a/.github/workflows/windows-menubar-ci.yml b/.github/workflows/windows-menubar-ci.yml
index 27a2ae4f8..a091b947c 100644
--- a/.github/workflows/windows-menubar-ci.yml
+++ b/.github/workflows/windows-menubar-ci.yml
@@ -53,6 +53,7 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
+          toolchain: stable
           components: clippy
 
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3