address review: pin setup-node and tauri-action to their release commits

- Add StepSecurity Harden-Runner to Linux, macOS, and Windows release publishing workflows
- Set persist-credentials: false on all actions/checkout steps
- Pin actions/checkout, actions/setup-node, dtolnay/rust-toolchain, actions/upload-artifact, actions/download-artifact, and tauri-apps/tauri-action to immutable commit SHAs
- Add 7-day cooldown to Dependabot for cargo and github-actions ecosystems

.github/dependabot.yml

@@ -14,6 +14,8 @@ updates:
           - "*"
     commit-message:
       prefix: "chore(deps)"
+    cooldown:
+      default-days: 7
 
   # Maintain GitHub Actions workflows
   - package-ecosystem: "github-actions"
@@ -28,3 +30,5 @@ updates:
           - "*"
     commit-message:
       prefix: "ci(deps)"
+    cooldown:
+      default-days: 7

.github/workflows/artcraft-linux-publish.yml

@@ -13,7 +13,37 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
+          allowed-endpoints: >
+            *.crates.io:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            *.microsoft.com:443
+            *.rust-lang.org:443
+            *.ubuntu.com:80
+            *.ubuntu.com:443
+            api.github.com:443
+            archive.ubuntu.com:80
+            archive.ubuntu.com:443
+            azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            packages.microsoft.com:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+            security.ubuntu.com:80
+            security.ubuntu.com:443
+            static.crates.io:443
+            static.rust-lang.org:443
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: storytold/craft-common-actions/actions/install-apt-packages@main
         with:
           packages: rpm jq binutils zsync
@@ -34,7 +64,37 @@ jobs:
       TAURI_FRONTEND_PATH: ${{ github.workspace }}/frontend
       TAURI_APP_PATH: ${{ github.workspace }}/crates/desktop/artcraft
     steps:
-      - uses: actions/checkout@v7
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
+          allowed-endpoints: >
+            *.crates.io:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            *.microsoft.com:443
+            *.rust-lang.org:443
+            *.ubuntu.com:80
+            *.ubuntu.com:443
+            api.github.com:443
+            archive.ubuntu.com:80
+            archive.ubuntu.com:443
+            azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            packages.microsoft.com:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+            security.ubuntu.com:80
+            security.ubuntu.com:443
+            static.crates.io:443
+            static.rust-lang.org:443
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: storytold/craft-common-actions/actions/install-apt-packages@main
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libclang-dev libasound2-dev libxdo-dev libdbus-1-dev build-essential clang file jq perl cmake nasm rpm zsync gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-libav
@@ -63,7 +123,7 @@ jobs:
           PKG_CONFIG_LIBDIR_riscv64gc_unknown_linux_gnu=/usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
           ENV
           echo "CMAKE_TOOLCHAIN_FILE_riscv64gc_unknown_linux_gnu=$GITHUB_WORKSPACE/packaging/linux/riscv64.cmake" >> "$GITHUB_ENV"
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: npm
@@ -80,7 +140,7 @@ jobs:
         working-directory: frontend
       - run: ./node_modules/.bin/nx run artcraft:build
         working-directory: frontend
-      - uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0
+      - uses: tauri-apps/tauri-action@6a45448f17a006facb105cc5257b3edbc353038a # v0.5.18
         with:
           projectPath: crates/desktop/artcraft
           args: --target ${{ matrix.target }} --bundles ${{ matrix.bundles }} --config ${{ github.workspace }}/packaging/linux/tauri.conf.json
@@ -89,7 +149,7 @@ jobs:
           ARCH: ${{ matrix.arch }}
           TARGET: ${{ matrix.target }}
         run: packaging/linux/package.sh "$ARCH" "$TARGET"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/release/*
@@ -102,8 +162,38 @@ jobs:
       matrix:
         arch: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v8
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
+          allowed-endpoints: >
+            *.crates.io:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            *.microsoft.com:443
+            *.rust-lang.org:443
+            *.ubuntu.com:80
+            *.ubuntu.com:443
+            api.github.com:443
+            archive.ubuntu.com:80
+            archive.ubuntu.com:443
+            azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            packages.microsoft.com:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+            security.ubuntu.com:80
+            security.ubuntu.com:443
+            static.crates.io:443
+            static.rust-lang.org:443
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/linux
@@ -126,7 +216,7 @@ jobs:
           for package in dist/release/*.pkg.tar.zst; do
             tar --zstd -xOf "$package" .PKGINFO | grep -Fx 'depend = webkit2gtk-4.1'
           done
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-arch-${{ matrix.arch }}
           path: dist/release/*.pkg.tar.zst
@@ -145,8 +235,38 @@ jobs:
           - {arch: x86_64, runner: ubuntu-24.04}
           - {arch: aarch64, runner: ubuntu-24.04-arm}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v8
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
+          allowed-endpoints: >
+            *.crates.io:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            *.microsoft.com:443
+            *.rust-lang.org:443
+            *.ubuntu.com:80
+            *.ubuntu.com:443
+            api.github.com:443
+            archive.ubuntu.com:80
+            archive.ubuntu.com:443
+            azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            packages.microsoft.com:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+            security.ubuntu.com:80
+            security.ubuntu.com:443
+            static.crates.io:443
+            static.rust-lang.org:443
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/linux
@@ -164,7 +284,7 @@ jobs:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
           DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
         run: packaging/linux/flatpak.sh
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-flatpak-${{ matrix.arch }}
           path: |
@@ -177,7 +297,37 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
+          allowed-endpoints: >
+            *.crates.io:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            *.microsoft.com:443
+            *.rust-lang.org:443
+            *.ubuntu.com:80
+            *.ubuntu.com:443
+            api.github.com:443
+            archive.ubuntu.com:80
+            archive.ubuntu.com:443
+            azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            packages.microsoft.com:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+            security.ubuntu.com:80
+            security.ubuntu.com:443
+            static.crates.io:443
+            static.rust-lang.org:443
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Read version
         id: version
         run: echo "value=$(jq -r .version crates/desktop/artcraft/tauri.conf.json)" >> "$GITHUB_OUTPUT"

.github/workflows/artcraft-macos-publish.yml

@@ -38,16 +38,37 @@ jobs:
     # Successful builds took 10-22 min (2026-04 to 2026-11).
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v7
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
+          allowed-endpoints: >
+            *.crates.io:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            api.github.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+            static.crates.io:443
+            static.rust-lang.org:443
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: setup node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/*
 
       - name: install Rust stable
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
+          toolchain: stable
           targets: ${{ matrix.platform == 'macos-latest-xlarge' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
       - name: install dependencies (ubuntu only)
@@ -226,7 +247,7 @@ jobs:
 
 
       - name: build and publish
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@6a45448f17a006facb105cc5257b3edbc353038a # v0.5.18
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_ID: ${{ secrets.APPLE_ID }}

.github/workflows/artcraft-windows-publish.yml

@@ -33,10 +33,36 @@ jobs:
     # Successful builds took 17-36 min (2026-04 to 2026-11); one hung run used the full 6-hour default.
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v7
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
+          allowed-endpoints: >
+            *.chocolatey.org:443
+            *.crates.io:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            api.github.com:443
+            chocolatey.org:443
+            community.chocolatey.org:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            packages.chocolatey.org:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+            static.crates.io:443
+            static.rust-lang.org:443
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: install Rust stable
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+        with:
+          toolchain: stable
 
       - name: install wreq dependencies
         run: |
@@ -48,7 +74,7 @@ jobs:
         shell: cmd
 
       - name: setup node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/*
 
@@ -101,7 +127,7 @@ jobs:
           $config | ConvertTo-Json -Depth 10 | Set-Content tauri.conf.json
 
       - name: build and publish
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@6a45448f17a006facb105cc5257b3edbc353038a # v0.5.18
         env:
           # NB(bt): This is needed by wreq. Hopefully it doesn't kill Tauri
           RUSTFLAGS: "-C target-feature=+crt-static"