Update all github workflow to use actions tied to sha hashes

[Omega359]

Is your feature request related to a problem or challenge?

A recent supply chain attack has made it extremely apparent that github workflows should only use actions that are tied to a specific hash, not a version. This applies to any non-github, non-apache action of which there seems to be a few:

• dev.yml -> - uses: korandoru/hawkeye@v6
• rust.yml -> - uses: korandoru/hawkeye@v6
• setup-macos-aarch64-builder/action.yaml -> uses: Swatinem/rust-cache@v2
• setup-rust-runtime/action.yaml -> uses: mozilla-actions/[email protected]

an example of how to use a sha hash instead of a version can be seen in the extended.yml file:

uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be

Describe the solution you'd like

No response

Describe alternatives you've considered

No response

Additional context

No response

[alamb]

Thank you @Omega359 -- I agree this is very important

[alamb]

I think this is a good first issue as the write up is clear and there is an example to follow

[Jiashu-Hu]

take

[SanjayUG]

Hi there,

I just checked this issue and tried to solved it.

Feel free for feedback.

Thank You.

[findepi]

A recent supply chain attack has made it extremely apparent that github workflows should only use actions that are tied to a specific hash, not a version. This applies to any non-github, non-apache action of which there seems to be a few:

This is very important. I don't understand why Github actions copied design from Docker world, where a version string is not a version 😞

Do you know if there is any automation to lint workflows for mutable-version-ref actions? Even if we solve this problem today (which we should!), automation could help us not get back to a bad state.

Do you maybe know if an action can be composite and reference downstream actions, potentially with mutable-version-ref? Is there an equivalent of Cargo.lock / package-lock.json for workflows? (i doubt but ...)

[alamb]

Do you know if there is any automation to lint workflows for mutable-version-ref actions?

I do now know of any myself

[alamb]

I think we have basically done this , eg https://github.com/apache/datafusion/blob/ed836d73970f5651cba0544326479bc8e2d72c54/.github/workflows/rust.yml#L58

Let's close this one now and we can reopen if there is more work to be done