ci: pin shared action dependencies

.github/workflows/auto-release.yml

@@ -36,7 +36,7 @@ jobs:
   auto-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -45,10 +45,11 @@ jobs:
       # validate identity AND export the normalized manifest (single source of
       # tag prefix + version file). validate-and-export fails here if identity
       # drifted on main — don't mint a tag against a bad manifest.
-      # NOTE: @v1 must be cut (rollout step #8) before any caller can use this
-      # workflow; until then these action refs won't resolve.
+      # Nested shared actions use the self-repository form so GitHub resolves them
+      # from the exact commit that supplied this reusable workflow. This requires
+      # an Actions runner at version 2.336.0 or newer.
       - id: identity
-        uses: open-cli-collective/.github/actions/identity-check@v1
+        uses: $/actions/identity-check
         with:
           manifest-path: ${{ inputs.manifest-path }}
           working-directory: ${{ inputs.working-directory }}
@@ -76,7 +77,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - id: gate
-        uses: open-cli-collective/.github/actions/auto-release@v1
+        uses: $/actions/auto-release
         with:
           release-paths: ${{ inputs.release-paths }}
           tool-paths: ${{ inputs.tool-paths }}

.github/workflows/release.yml

@@ -7,8 +7,9 @@ name: Release (reusable)
 # comes from packaging/identity.yml via identity-check — a repo declares it once.
 # See cli-common distribution.md / release.md.
 #
-# NOTE: @v1 must be cut (rollout step #8 follow-up) before any caller can use
-# this workflow; until then the action refs below won't resolve.
+# Callers must pin this reusable workflow to an immutable shared commit. Nested
+# shared actions use the self-repository form below so they resolve from that
+# same commit. This requires an Actions runner at version 2.336.0 or newer.
 on:
   workflow_call:
     inputs:
@@ -75,14 +76,14 @@ jobs:
       linux-matrix: ${{ steps.meta.outputs.linux-matrix }}
       keychain-matrix: ${{ steps.meta.outputs.keychain-matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0
           fetch-tags: true
 
       # validate identity AND export the normalized manifest in one call.
       - id: identity
-        uses: open-cli-collective/.github/actions/identity-check@v1
+        uses: $/actions/identity-check
         with:
           manifest-path: ${{ inputs.manifest-path }}
           working-directory: ${{ inputs.working-directory }}
@@ -143,17 +144,17 @@ jobs:
       # goreleaser-config preflight: idempotent re-runs + cask skip_upload so the
       # homebrew-alias step is the single atomic tap writer. goreleaser_config is
       # repo-root-relative (goreleaser runs from root in both repo shapes).
-      - uses: open-cli-collective/.github/actions/release-preflight@v1
+      - uses: $/actions/release-preflight
         with:
           goreleaser-config: ${{ fromJSON(steps.meta.outputs.identity-json).goreleaser_config }}
           homebrew: ${{ steps.meta.outputs.has-homebrew }}
           tag-prefix: ${{ fromJSON(steps.meta.outputs.identity-json).tag.prefix }}
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: ${{ inputs.working-directory }}/go.mod
 
-      - uses: goreleaser/goreleaser-action@v6
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: "~> v2"
           install-only: true
@@ -171,7 +172,7 @@ jobs:
       # cert secrets (all-or-none) so an opt-out caller no-ops. MUST precede the snapshot
       # build so both goreleaser runs inherit the exported SIGN_IDENTITY / CODESIGN_DARWIN_SCRIPT.
       - name: macOS code-signing setup
-        uses: open-cli-collective/.github/actions/macos-codesign-setup@v1
+        uses: $/actions/macos-codesign-setup
         with:
           cert-p12: ${{ secrets.macos-cert-p12 }}
           cert-password: ${{ secrets.macos-cert-password }}
@@ -219,7 +220,7 @@ jobs:
       # no keychain_probe (no credstore backend to verify).
       - name: CGO-darwin gate
         if: steps.meta.outputs.has-keychain == 'true'
-        uses: open-cli-collective/.github/actions/darwin-gate@v1
+        uses: $/actions/darwin-gate
         with:
           dist-path: dist
           binaries: ${{ steps.meta.outputs.keychain-matrix }}
@@ -292,7 +293,7 @@ jobs:
 
       - name: Upload dist
         if: ${{ !inputs.dry-run }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist
           path: dist
@@ -312,8 +313,8 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.goreleaser.outputs.homebrew-matrix) }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist
@@ -326,7 +327,7 @@ jobs:
           cask="$(find dist -name "${CANONICAL}.rb" -print -quit)"
           [ -n "$cask" ] || { echo "::error::canonical cask ${CANONICAL}.rb not found in dist artifact"; exit 1; }
           echo "cask=$cask" >> "$GITHUB_OUTPUT"
-      - uses: open-cli-collective/.github/actions/homebrew-alias@v1
+      - uses: $/actions/homebrew-alias
         with:
           canonical-cask-file: ${{ steps.locate.outputs.cask }}
           canonical-token: ${{ matrix.canonical_cask }}
@@ -350,7 +351,7 @@ jobs:
       ARM64_ASSET: ${{ matrix.arm64_asset }}
       CHOCO_DIR: ${{ matrix.dir }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Get checksums from release
         shell: pwsh
         env:
@@ -384,7 +385,7 @@ jobs:
           $content = $content -replace 'CHECKSUM_ARM64_PLACEHOLDER', $env:ARM64_HASH
           Set-Content $script $content
       - name: Pack and push
-        uses: open-cli-collective/.github/actions/chocolatey-push@v1
+        uses: $/actions/chocolatey-push
         with:
           package-id: ${{ matrix.id }}
           working-directory: ${{ inputs.working-directory }}
@@ -407,8 +408,8 @@ jobs:
       FINAL_TAG: ${{ needs.goreleaser.outputs.final-tag }}
       WINGET_ID: ${{ matrix.id }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: open-cli-collective/.github/actions/winget-submit@v1
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: $/actions/winget-submit
         with:
           package-id: ${{ matrix.id }}
           version: ${{ needs.goreleaser.outputs.version }}

.github/workflows/test-actions.yml

@@ -21,15 +21,15 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - uses: ./actions/go-build
         with:
           working-directory: tests/fixtures/minimal
 
   test-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - uses: ./actions/go-test
         with:
           working-directory: tests/fixtures/minimal
@@ -46,7 +46,7 @@ jobs:
   grammar:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: grammar matrix
         shell: bash
         run: |
@@ -81,22 +81,22 @@ jobs:
   integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: conventional-commit action (valid)
         uses: ./actions/conventional-commit
         with:
           mode: title
           message: "feat(api): wire up the thing"
       - name: pr-title action (valid)
-        uses: ./actions/pr-title
+        uses: $/actions/pr-title
         with:
           title: "fix: handle empty config"
       # Negative case: proves the env→arg wiring actually rejects (a regression
       # like an empty TITLE must not pass silently).
       - name: pr-title action (invalid — must fail)
         id: badtitle
         continue-on-error: true
-        uses: ./actions/pr-title
+        uses: $/actions/pr-title
         with:
           title: "not a conventional title"
       - name: assert invalid title was rejected
@@ -111,10 +111,10 @@ jobs:
   auto-release-gate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - run: bash actions/auto-release/test_gate.sh
         shell: bash
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
       - run: pip install "PyYAML==6.0.2"
@@ -128,7 +128,7 @@ jobs:
   darwin-gate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - run: bash actions/darwin-gate/test_darwin_gate.sh
         shell: bash
 
@@ -137,24 +137,24 @@ jobs:
   macos-codesign-setup:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - run: bash actions/macos-codesign-setup/test_gate.sh
         shell: bash
 
   # homebrew alias-cask rendering (token rename, verbatim url/checksum copy).
   homebrew-alias:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - run: bash actions/homebrew-alias/test_alias.sh
         shell: bash
 
   # goreleaser-config preflight (replace_existing_artifacts + cask skip_upload).
   release-preflight:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
       - run: pip install "PyYAML==6.0.2" "pytest>=8,<9"
@@ -168,8 +168,8 @@ jobs:
   winget-submit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
       - run: pip install "PyYAML==6.0.2" "pytest>=8,<9"
@@ -183,8 +183,8 @@ jobs:
   chocolatey-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
       - run: pip install "pytest>=8,<9" "defusedxml==0.7.1"
@@ -197,8 +197,8 @@ jobs:
   identity-unit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
       - run: pip install "PyYAML==6.0.2" "pytest>=8,<9" "defusedxml==0.7.1"
@@ -215,7 +215,7 @@ jobs:
       matrix:
         fixture: [slck, gro, nrq, jtk, google-cli]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - uses: ./actions/identity-check
         with:
           working-directory: tests/fixtures/identity/${{ matrix.fixture }}
@@ -230,7 +230,7 @@ jobs:
   identity-monorepo:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - uses: ./actions/identity-check
         with:
           working-directory: tests/fixtures/identity/monorepo/tools/cfl
@@ -240,7 +240,7 @@ jobs:
   identity-interface:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - id: export
         uses: ./actions/identity-check
         with:

actions/chocolatey-push/action.yml

@@ -18,7 +18,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: "3.12"
     - shell: bash

actions/go-build/action.yml

@@ -12,7 +12,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: ${{ inputs.working-directory }}/${{ inputs.go-version-file }}
     - shell: bash

actions/go-lint/action.yml

@@ -12,7 +12,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: ${{ inputs.working-directory }}/${{ inputs.go-version-file }}
     # A lint config is required; golangci defaults are non-conformant (repo-layout.md §5).
@@ -26,7 +26,7 @@ runs:
           echo "::error::no .golangci.{yml,yaml,toml} in the module root — a per-module lint config is required (repo-layout.md §5, ci.md §5); golangci defaults are non-conformant"
           exit 1
         fi
-    - uses: golangci/golangci-lint-action@v7
+    - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
       with:
         version: v2.12.2
         working-directory: ${{ inputs.working-directory }}

actions/go-test/action.yml

@@ -16,7 +16,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: ${{ inputs.working-directory }}/${{ inputs.go-version-file }}
     - shell: bash

actions/identity-check/action.yml

@@ -28,7 +28,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: "3.12"
     - shell: bash

actions/release-preflight/action.yml

@@ -21,7 +21,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: "3.12"
     - shell: bash

actions/winget-submit/action.yml

@@ -48,7 +48,7 @@ runs:
           echo "::error::winget-submit requires a Windows runner because wingetcreate.exe is Windows-only"
           exit 1
         fi
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: "3.12"
     - shell: bash