Pin all third-party GitHub Actions to immutable commit SHAs across CI workflows

[niStee]

Description

ultraworkers/claw-code has no explicit policy requiring SHA pinning for third-party GitHub Actions. The three workflows in .github/workflows/ (release.yml, rust-ci.yml, rust.yml) reference actions by floating tags:

• actions/checkout@v4
• actions/setup-python@v5
• actions/upload-artifact@v4
• softprops/action-gh-release@v2
• Swatinem/rust-cache@v2

GitHub's security hardening guide for Actions recommends pinning third-party actions to a full-length commit SHA to defend against a compromised or malicious tag — a tag is mutable, a SHA is immutable. Sister projects in the same space (topgrade-rs/topgrade, devswha/gajae-code) already enforce this.

This repo is too small to need a separate hardening ticket for every workflow. Filing one issue to cover all three.

Risk

• Tag-mutation attack: a compromised upstream maintainer (or someone who steals their npm token) re-points @v4 to a malicious commit. Consumers running @v4 get pwned on the next workflow run.
• Audit trail: pinning to SHA means the workflow content reflects exactly what you reviewed at that moment — important for supply-chain attestations.

Proposed solution

Convert every floating tag to SHA + comment in the three workflows. Suggested SHA picks (latest v4/v5 release as of 2026-08-10):

• actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 (or pin to v4.4.0)
• actions/setup-python@... (full SHA for the v5 release)
• actions/upload-artifact@... (full SHA for the v4 release)
• softprops/action-gh-release@... (full SHA for the v2 release)
• Swatinem/rust-cache@... (full SHA for the v2 release)

I'll file a separate PR with the SHA-pinned versions once this issue has a maintainer ack. PR will use the "anti-slop" resolution gate from .github/PULL_REQUEST_TEMPLATE.md: this issue is the linked evidence.

Alternatives considered

• Renovate config to auto-pin: heavier change; not justified for 3 workflows. Re-evaluate if the project adds more workflows.
• Dependabot monthly (as CatoTH/antragsgruen does): Dependabot does offer action-version PRs but doesn't pin to SHA by default — same gap.

Environment

• claw-code current state: 3 workflow files using @vN refs
• This is a triage-only report — no remote state was modified to write it.

[1716775457damn]

Strong agree with pinning third-party Actions to full commit SHAs — the tag-mutation attack scenario is exactly why GitHub's hardening guide recommends it. Since it's only 3 workflows, one sweep PR covering all three (with the SHA + comment pattern) keeps it reviewable. Also worth considering Dependabot's �ersion-update with a SHA-comment convention later, but this issue as-is is a good first step.