From a787c371f63363aac17ce1a625f34230e5ea1b2f Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 11 Nov 2026 14:57:24 -0500
Subject: [PATCH] ci: use StepSecurity's maintained actions (#2832)

Each third-party action that StepSecurity publishes a secure drop-in
replacement for now uses that replacement, pinned to a commit with its
version as a comment. Versions follow what we used: the newest
StepSecurity release in the same major, or the closest major they
publish. dtolnay/rust-toolchain refs that named a toolchain (stable,
nightly, 1.76) become the replacement's `toolchain` input.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Chores**
* Updated the Linux, macOS, and Windows release workflows to use pinned
build and publishing actions. Stable Rust toolchain selection and
existing target settings are preserved.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .github/workflows/artcraft-linux-publish.yml   | 6 +++---
 .github/workflows/artcraft-macos-publish.yml   | 5 +++--
 .github/workflows/artcraft-windows-publish.yml | 6 ++++--
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/artcraft-linux-publish.yml b/.github/workflows/artcraft-linux-publish.yml
index 3faf3a1863..f1beaebf20 100644
--- a/.github/workflows/artcraft-linux-publish.yml
+++ b/.github/workflows/artcraft-linux-publish.yml
@@ -76,11 +76,11 @@ jobs:
           node-version: '22'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
           targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: tauri-linux-${{ matrix.arch }}
           cache-on-failure: true
@@ -88,7 +88,7 @@ jobs:
         working-directory: frontend
       - run: ./node_modules/.bin/nx run artcraft:build
         working-directory: frontend
-      - uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0
+      - uses: step-security/tauri-action@dc662d498edbd35ec8ed564b45d44e955444d1bc # v1.0.0
         with:
           projectPath: crates/desktop/artcraft
           args: --target ${{ matrix.target }} --bundles ${{ matrix.bundles }} --config ${{ github.workspace }}/packaging/linux/tauri.conf.json
diff --git a/.github/workflows/artcraft-macos-publish.yml b/.github/workflows/artcraft-macos-publish.yml
index 6991530beb..07d2d8af04 100644
--- a/.github/workflows/artcraft-macos-publish.yml
+++ b/.github/workflows/artcraft-macos-publish.yml
@@ -50,8 +50,9 @@ jobs:
           node-version: lts/*
 
       - name: install Rust stable
-        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
+          toolchain: stable
           targets: ${{ matrix.platform == 'macos-latest-xlarge' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
       - name: install dependencies (ubuntu only)
@@ -229,7 +230,7 @@ jobs:
 
 
       - name: build and publish
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0
+        uses: step-security/tauri-action@dc662d498edbd35ec8ed564b45d44e955444d1bc # v1.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
diff --git a/.github/workflows/artcraft-windows-publish.yml b/.github/workflows/artcraft-windows-publish.yml
index f878a006af..56384ccdc9 100644
--- a/.github/workflows/artcraft-windows-publish.yml
+++ b/.github/workflows/artcraft-windows-publish.yml
@@ -40,7 +40,9 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: install Rust stable
-        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
+        with:
+          toolchain: stable
 
       - name: install wreq dependencies
         run: |
@@ -105,7 +107,7 @@ jobs:
           $config | ConvertTo-Json -Depth 10 | Set-Content tauri.conf.json
 
       - name: build and publish
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0
+        uses: step-security/tauri-action@dc662d498edbd35ec8ed564b45d44e955444d1bc # v1.0.0
         env:
           # NB(bt): This is needed by wreq. Hopefully it doesn't kill Tauri
           RUSTFLAGS: "-C target-feature=+crt-static"