ci: use StepSecurity's maintained actions (#206)

* ci: use StepSecurity's maintained actions

Each third-party action that StepSecurity publishes a secure drop-in
replacement for now uses that replacement, pinned to a commit with its
version as a comment. Versions follow what we used: the newest
StepSecurity release in the same major, or the closest major they
publish. dtolnay/rust-toolchain refs that named a toolchain (stable,
nightly, 1.76) become the replacement's `toolchain` input.

* tests: find the FreeBSD VM, SonarCloud scan and install-action steps by their StepSecurity names

.github/workflows/docker-build.yml

@@ -142,11 +142,11 @@ jobs:
         run: bash --noprofile --norc -eo pipefail -c "$PRE_BUILD_COMMAND"
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: step-security/setup-buildx-action@e50058a0fcd8d1a7d626c905502d010a468bf238 # v4.4.1
 
       - name: Log in to Docker Hub (DHI base images)
         if: ${{ inputs.dhi-login }}
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: step-security/docker-login-action@8c7b695d8738c5699a679ff5254baf0f19f20a94 # v4.6.0
         with:
           registry: dhi.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -154,7 +154,7 @@ jobs:
 
       - name: Log in to GHCR
         if: ${{ contains(inputs.images, 'ghcr.io') }}
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: step-security/docker-login-action@8c7b695d8738c5699a679ff5254baf0f19f20a94 # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -162,7 +162,7 @@ jobs:
 
       - name: Log in to Docker Hub
         if: ${{ contains(inputs.images, 'docker.io/') }}
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: step-security/docker-login-action@8c7b695d8738c5699a679ff5254baf0f19f20a94 # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -268,11 +268,11 @@ jobs:
           merge-multiple: true
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: step-security/setup-buildx-action@e50058a0fcd8d1a7d626c905502d010a468bf238 # v4.4.1
 
       - name: Log in to GHCR
         if: ${{ contains(inputs.images, 'ghcr.io') }}
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: step-security/docker-login-action@8c7b695d8738c5699a679ff5254baf0f19f20a94 # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -280,14 +280,14 @@ jobs:
 
       - name: Log in to Docker Hub
         if: ${{ contains(inputs.images, 'docker.io/') }}
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: step-security/docker-login-action@8c7b695d8738c5699a679ff5254baf0f19f20a94 # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Docker metadata
         id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: step-security/metadata-action@21378f5b76c96c69ac34d21cc3873d85e26381b1 # v6.2.0
         with:
           images: ${{ inputs.images }}
           tags: ${{ inputs.tags }}

.github/workflows/freebsd.yml

@@ -101,7 +101,7 @@ jobs:
       - name: Drop the Microsoft apt source
         run: sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/microsoft-prod.sources
       - name: Start the FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
+        uses: step-security/freebsd-vm@a2f5754275f7b0d5cea7f2762c9960727950f128 # v1.5.9
         with:
           release: ${{ inputs.freebsd-release == '15.1-STABLE' && '15.1' || inputs.freebsd-release }}
           # Always an x86_64 guest, which KVM accelerates: aarch64 is cross-compiled in it,

.github/workflows/gate.yml

@@ -237,7 +237,7 @@ jobs:
 
       - name: Install cargo tools
         if: inputs.tools != ''
-        uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
+        uses: step-security/taiki-e-install-action@76747d22a7567cc4438546a84f11bdf18e670ab8 # v2.87.32
         with:
           tool: ${{ inputs.tools }}
 
@@ -264,7 +264,7 @@ jobs:
 
       # Default-branch writes remain the default. Maintainers can explicitly opt manual
       # branch runs into branch-scoped writes; pull-request runs never save a cache.
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           prefix-key: ${{ inputs.cache-version }}-rust
           key: ${{ steps.cache-profile.outputs.key }}

.github/workflows/release.yml

@@ -277,11 +277,11 @@ jobs:
           ref: ${{ inputs.craft-fonts-ref }}
       - name: Check out craft-i18n
         uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
           targets: aarch64-apple-darwin, x86_64-apple-darwin
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: release-macos-universal
       - name: Apply version override
@@ -405,11 +405,11 @@ jobs:
           ref: ${{ inputs.craft-fonts-ref }}
       - name: Check out craft-i18n
         uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
           targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: release-windows-${{ matrix.arch }}
       - name: Apply version override
@@ -496,10 +496,10 @@ jobs:
         with:
           deb-arch: ${{ matrix.deb }}
           nfpm-version: ${{ inputs.nfpm-version }}
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: release-linux-${{ matrix.arch }}
       - name: Apply version override
@@ -795,7 +795,7 @@ jobs:
       - name: Check out craft-i18n
         uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
       - name: Start the FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
+        uses: step-security/freebsd-vm@a2f5754275f7b0d5cea7f2762c9960727950f128 # v1.5.9
         with:
           release: ${{ inputs.freebsd-release == '15.1-STABLE' && '15.1' || inputs.freebsd-release }}
           # Always an x86_64 guest, which KVM accelerates: aarch64 is cross-compiled in it,
@@ -1011,11 +1011,11 @@ jobs:
           app-name: ${{ inputs.app-name }}
           version: ${{ needs.version.outputs.version }}
           date: ${{ needs.version.outputs.date }}
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
           targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: release-web
       - uses: storytold/craft-common-actions/actions/install-trunk@main
@@ -1096,11 +1096,11 @@ jobs:
           ref: ${{ inputs.craft-fonts-ref }}
       - name: Check out craft-i18n
         uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
           targets: riscv64gc-unknown-linux-gnu
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: release-linux-riscv64
       - name: Apply version override
@@ -1191,10 +1191,10 @@ jobs:
           date: ${{ needs.version.outputs.date }}
       - name: Check out craft-i18n
         uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: release-server-${{ matrix.arch }}
       - name: Apply version override

.github/workflows/sonarcloud.yml

@@ -240,10 +240,10 @@ jobs:
         run: |
           rustup toolchain install stable --profile minimal --component llvm-tools-preview
           rustup default stable
-      - uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
+      - uses: step-security/taiki-e-install-action@76747d22a7567cc4438546a84f11bdf18e670ab8 # v2.87.32
         with:
           tool: cargo-llvm-cov,cargo-nextest@0.9.150
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Provision pinned PDF test fonts
@@ -359,7 +359,7 @@ jobs:
             pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev
             libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libasound2-dev libsoup-3.0-dev libwebkit2gtk-4.1-dev
             libgl1-mesa-dev mesa-vulkan-drivers
-      - uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
+      - uses: step-security/taiki-e-install-action@76747d22a7567cc4438546a84f11bdf18e670ab8 # v2.87.32
         with:
           tool: cargo-nextest@0.9.150
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -533,11 +533,11 @@ jobs:
         run: |
           rustup toolchain install stable --profile minimal --component llvm-tools-preview
           rustup default stable
-      - uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
+      - uses: step-security/taiki-e-install-action@76747d22a7567cc4438546a84f11bdf18e670ab8 # v2.87.32
         if: steps.token.outputs.available == 'true' && hashFiles('Cargo.toml') != '' && inputs.shards <= 1
         with:
           tool: cargo-llvm-cov
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         if: steps.token.outputs.available == 'true' && hashFiles('Cargo.toml') != '' && inputs.shards <= 1
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -687,7 +687,7 @@ jobs:
           echo "status=$status" >>"$GITHUB_OUTPUT"
       - name: SonarCloud Scan
         if: steps.token.outputs.available == 'true'
-        uses: SonarSource/sonarqube-scan-action@e805d875275f728fac1885b413934be6d7c63f65 # v8.4.1
+        uses: step-security/sonarqube-scan-action@c2312f8888f2bff4220bd815febb9d4a7cb32433 # v8.2.1
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_CLOUD_PAT || secrets.SONAR_TOKEN }}
           SONAR_HOST_URL: https://sonarcloud.io

.github/workflows/windows-arm64.yml

@@ -76,14 +76,14 @@ jobs:
           persist-credentials: false
       - name: Check out craft-i18n
         uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
           targets: aarch64-pc-windows-msvc
       # The nightly run on main saves; pull requests and `release` restore it. A pull request's
       # cache (about 0.7 GB) is visible to that pull request alone, and the apps' caches sit at
       # the 10 GB limit, so each one evicted a cache main's gate restores.
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           key: windows-arm64-package
           save-if: ${{ github.ref == 'refs/heads/main' }}

tests/test_contributor_refresh.py

@@ -134,7 +134,7 @@ Path('contributors/contributors.json').write_text(json.dumps(credits))
                 self.assertEqual(settings['path'], 'contributors')
                 build_steps = [i for i, s in enumerate(steps)
                                if 'cargo ' in s.get('run', '') or 'packaging/' in s.get('run', '')
-                               or 'vmactions/freebsd-vm@' in s.get('uses', '')]
+                               or 'step-security/freebsd-vm@' in s.get('uses', '')]
                 self.assertTrue(build_steps)
                 self.assertTrue(all(download < i for i in build_steps))
                 self.assertNotIn('continue-on-error', steps[download])

tests/test_freebsd.py

@@ -120,7 +120,7 @@ fi
             for key in ("CRAFT_FONTS_DIR", "CRAFT_FONTS_REQUIRED"):
                 env.pop(key, None)
             # The VM wrapper forwards only the configured SSH SendEnv names.
-            vm = next(step for step in STEPS if step.get("uses", "").startswith("vmactions/freebsd-vm@"))
+            vm = next(step for step in STEPS if step.get("uses", "").startswith("step-security/freebsd-vm@"))
             forwarded = vm["with"]["envs"].split()
             configured = {**DATA["jobs"]["freebsd"].get("env", {}), **BUILD_STEP.get("env", {})}
             env.update({key: re.sub(r"\$\{\{ inputs\.(.*?) \}\}", replace, value)

tests/test_freebsd_cache.py

@@ -278,7 +278,7 @@ class WorkflowCacheIntegrationTests(unittest.TestCase):
                 job = data["jobs"]["freebsd"]
                 steps = job["steps"]
                 index = lambda name: next(i for i, step in enumerate(steps) if step.get("name") == name)
-                vm = next(step for step in steps if step.get("uses", "").startswith("vmactions/freebsd-vm@"))
+                vm = next(step for step in steps if step.get("uses", "").startswith("step-security/freebsd-vm@"))
                 self.assertEqual(vm["with"]["copyback"], "false")
                 for variable in ("CARGO_HOME", "CARGO_TARGET_DIR", "CARGO_INCREMENTAL", "CARGO_BUILD_JOBS"):
                     self.assertIn(variable, vm["with"]["envs"].split())

tests/test_nextest_versions.py

@@ -99,7 +99,7 @@ class NextestVersionTests(unittest.TestCase):
         gate = self.documents[GATE]
         self.assertEqual(gate['on']['workflow_call']['inputs']['tools']['default'], PIN)
         installers = [step for step in gate['jobs']['gate']['steps']
-                      if step.get('uses', '').startswith('taiki-e/install-action@')]
+                      if step.get('uses', '').startswith('step-security/taiki-e-install-action@')]
         self.assertEqual(len(installers), 1)
         self.assertEqual(installers[0]['with']['tool'], '${{ inputs.tools }}')
         self.assertEqual(installers[0]['if'], "inputs.tools != ''")
@@ -109,7 +109,7 @@ class NextestVersionTests(unittest.TestCase):
         for job, expected in [('build', 'cargo-llvm-cov,' + PIN), ('coverage', PIN)]:
             with self.subTest(job=job):
                 installers = [step for step in jobs[job]['steps']
-                              if step.get('uses', '').startswith('taiki-e/install-action@')]
+                              if step.get('uses', '').startswith('step-security/taiki-e-install-action@')]
                 self.assertEqual(len(installers), 1)
                 self.assertEqual(installers[0]['with']['tool'], expected)
 
@@ -137,7 +137,7 @@ class NextestVersionTests(unittest.TestCase):
             with self.subTest(tool=tool):
                 changed = deepcopy(self.documents)
                 changed[SONAR]['jobs']['coverage']['steps'].append({
-                    'uses': 'taiki-e/install-action@' + '0' * 40,
+                    'uses': 'step-security/taiki-e-install-action@' + '0' * 40,
                     'with': {'tool': tool},
                 })
                 with self.assertRaises(AssertionError):

tests/test_release_inputs.py

@@ -51,7 +51,7 @@ Path('args.json').write_text(json.dumps(sys.argv[1:]))
             configured = {**job.get('env', {}), **step.get('env', {})}
             if job_name == 'freebsd':
                 vm = next(item for item in job['steps']
-                          if item.get('uses', '').startswith('vmactions/freebsd-vm@'))
+                          if item.get('uses', '').startswith('step-security/freebsd-vm@'))
                 forwarded = vm['with']['envs'].split()
                 configured = {key: value for key, value in configured.items() if key in forwarded}
             env.update({key: value.replace(EXPRESSION, app_name)

tests/test_sonarcloud.py

@@ -22,7 +22,7 @@ class SonarCloudTests(unittest.TestCase):
         self.steps = workflow['jobs']['sonarcloud']['steps']
         self.validation = next(step for step in self.steps if step.get('id') == 'project')
         self.scan = next(step for step in self.steps
-                         if step.get('uses', '').startswith('SonarSource/sonarqube-scan-action@'))
+                         if step.get('uses', '').startswith('step-security/sonarqube-scan-action@'))
 
     def run_step(self, step, **env):
         with tempfile.TemporaryDirectory() as temp: