ci: consolidate action pins — one SHA per action, no moving tags

.github/workflows/sovereign-ci.yml

@@ -4,7 +4,7 @@
 # Change once here → applies to all 38 repos instantly.
 #
 # Self-hosted jobs run inside the sovereign-ci container (built by forjar).
 # Each job gets an isolated filesystem — no shared ~/.rustup/, no race conditions.
 # Image: localhost:5000/sovereign-ci:stable (local registry on mac-server)
 # Rebuild: cd infra && make -f machines/intel/Makefile ci-image
 #
@@ -48,22 +48,22 @@
         default: false
         type: boolean
       extra_pkgs:
         description: 'Extra apt packages to install in container (e.g. python3-dev libclang-dev)'
         required: false
         default: ''
         type: string
       enable_sccache:
         description: 'sccache compiler cache (build-performance.md §5.3). Fleet-default on 2026-04-18 after Phase 3 pilot: F9 p95=100%, n=24 runs, median=100%. Set false to disable per-repo.'
         required: false
         default: true
         type: boolean
       use_nextest:
         description: 'cargo nextest run instead of cargo test (build-performance.md §4.3 + §7 Phase 2). 30-40% test-job speedup on large suites. Pilot repos only until F11 test-job p95 ≤ 300s verified over 7 days.'
         required: false
         default: false
         type: boolean
       test_workspace:
         description: 'PMAT-159: test all workspace members with `--workspace --lib` (not just root). Opt-in because workspace members may not build in the sovereign-ci container (e.g. aprender-gpu needs cuBLAS). Pair with test_args exclusions as needed.'
         required: false
         default: false
         type: boolean
@@ -108,7 +108,7 @@
 jobs:
   test:
     name: test
     runs-on: [self-hosted, clean-room]
     container:
       image: localhost:5000/sovereign-ci:stable@sha256:01bdebefb45996df96de71cfd194d89d68ea3beff4532d480d01307888f483be
       # infra#148 (PMAT-191): per-container CPU ceiling. Job containers run in
@@ -131,7 +131,7 @@
         # is not concurrent-safe and collides with "No such file or directory"
         # errors (15 observed on aprender PR #1019). Mirrors the aprender
         # workspace-test pattern (task #134).
         - /mnt/nvme-raid0/targets/sovereign-ci-${{ inputs.repo }}/${{ github.event.pull_request.number || github.ref_name }}:/workspace/target
     # PMAT-159 (2026-04-20): bumped 30→60 min so workspace-mode callers
     # (test_workspace: true) have headroom to compile + test large workspaces.
     # Default --lib callers are well under 30 min; the ceiling only binds for
@@ -140,7 +140,7 @@
     env:
       CARGO_TARGET_DIR: /workspace/target
     steps:
       # PRE-CHECKOUT SELF-HEAL — FIVE-WHYS ROOT CAUSE (2026-07-27, paiml/.github#42):
       # 1. Why did `ci / security` fail before running a single step of its own?
       #    actions/checkout's `git clean -ffdx` hit EACCES on root-owned
       #    target/ files and then died with "not a git repository" on the
@@ -187,12 +187,12 @@
           # uid:gid because the runner user has no entry in the image's passwd.
           chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true
           echo "pre-checkout ownership restored under $WORK_ROOT"
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
         if: ${{ inputs.extra_pkgs != '' }}
         run: |
           apt-get update -qq && apt-get install -y -qq ${{ inputs.extra_pkgs }} 2>/dev/null || \
           sudo apt-get update -qq && sudo apt-get install -y -qq ${{ inputs.extra_pkgs }} 2>/dev/null || true
       - name: Checkout sibling repos (path deps)
@@ -244,7 +244,7 @@
           # Note: generated contract macros may have unused variables (provable-contracts#64).
           # This is handled by adding -A unused-variables to the clippy step.
       - name: Generate contract assertions (pv codegen)
         run: |
           # pv is baked into sovereign-ci:stable at /usr/local/cargo/bin/pv
           PV=""
           for candidate in /usr/local/cargo/bin/pv /usr/local/bin/pv; do
@@ -295,7 +295,7 @@
           SCCACHE_DIR: ${{ inputs.enable_sccache && '/sccache' || '' }}
           USE_NEXTEST: ${{ inputs.use_nextest }}
           TEST_SCOPE: ${{ inputs.test_workspace && '--workspace --lib' || '--lib' }}
         run: |
           # Mark workspace as safe for git operations inside tests (dubious ownership in containers)
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           # Phase 2 §4.3 — nextest drops ~35% off test-job wall-clock on large suites.
@@ -410,7 +410,7 @@
           # uid:gid because the runner user has no entry in the image's passwd.
           chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true
           echo "pre-checkout ownership restored under $WORK_ROOT"
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -617,7 +617,7 @@
           # uid:gid because the runner user has no entry in the image's passwd.
           chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true
           echo "pre-checkout ownership restored under $WORK_ROOT"
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -885,7 +885,7 @@
           # uid:gid because the runner user has no entry in the image's passwd.
           chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true
           echo "pre-checkout ownership restored under $WORK_ROOT"
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -999,7 +999,7 @@
             2>/dev/null || echo "::warning::sccache stats unavailable"
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: bench-${{ inputs.repo }}
           path: bench-results.txt
@@ -1088,7 +1088,7 @@
           else
             echo "pre-checkout ownership restored under $WORK_ROOT"
           fi
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -1243,7 +1243,7 @@
       attestations: write
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Generate SLSA provenance