norrietaylor · Jul 28, 2026 · Jul 25, 2026 · Jul 25, 2026 · Jul 25, 2026 · Jul 25, 2026
@@ -0,0 +1,8 @@
+# actionlint configuration for the nightly `hygiene` job (actionlint over
+# .github/workflows/). Declares hosted runner labels that are newer than the
+# actionlint release's built-in label list so they are not flagged as unknown.
+self-hosted-runner:
+  labels:
+    # GitHub-hosted arm64 image used by the release lane; newer than
+    # actionlint 1.7.12's bundled label set.
+    - ubuntu-26.04-arm
@@ -27,7 +27,7 @@ runs:
         shared-key: ${{ inputs.shared-key }}
         save-if: ${{ inputs.save-if }}
     - name: Install nextest
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3d7d7cd5ac7f994c1892ae0c06165095b9139094 # v2
       with:
         tool: nextest
     - name: Check Cargo.lock is up-to-date

@@ -50,7 +50,7 @@ runs:
       # The mini needs no cache action: the input-keyed prefix under $HOME
       # persists across runs on its own.
       if: runner.environment == 'github-hosted'
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: ~/.cache/minimal-ci/libkrun
         key: libkrun-macos-${{ runner.arch }}-${{ steps.pin.outputs.commit }}-${{ steps.pin.outputs.script_hash }}-${{ steps.pin.outputs.patches_hash }}

@@ -24,7 +24,7 @@ runs:
   using: composite
   steps:
     - name: Free Disk Space
-      uses: endersonmenezes/free-disk-space@v3 # Use @main for latest, @v3 for stable
+      uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3
       with:
         remove_android: true
         remove_dotnet: true
@@ -42,7 +42,7 @@ runs:
       shell: bash
       run: echo "CARGO_PROFILE_DEV_DEBUG=line-tables-only" >> "$GITHUB_ENV"
     - name: Cache cargo registry and build artifacts
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       with:
         shared-key: ${{ inputs.shared-key }}
         save-if: ${{ inputs.save-if }}
@@ -45,7 +45,7 @@ jobs:
     outputs:
       kvm: ${{ steps.filter.outputs.kvm }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Detect relevant changes
@@ -95,18 +95,20 @@ jobs:
         # free on a fresh GitHub-hosted Ubuntu runner. `remove_tool_cache:
         # true` reclaims /opt/hostedtoolcache (~14 GB); the dtolnay step below
         # reinstalls the Rust toolchain we actually need.
-        uses: endersonmenezes/free-disk-space@v3 # Use @main for latest, @v3 for stable
+        uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3
         with:
           remove_android: true
           remove_dotnet: true
           remove_haskell: true
           remove_tool_cache: true
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
 
       - name: Install build dependencies
         # protoc + libprotobuf-dev: the `minimal` CLI (materialize) build. The
@@ -121,14 +123,14 @@ jobs:
                protobuf-compiler libprotobuf-dev cpio git'
 
       - name: Install cross + nextest
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@3d7d7cd5ac7f994c1892ae0c06165095b9139094 # v2
         with:
           tool: cross,nextest
 
       - name: Cache cargo + build artifacts
         # Restore-only; the save half (main only) runs at the end of the job.
         id: cargo-cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: |
             ~/.cargo/bin/
@@ -182,7 +184,7 @@ jobs:
           tar czf testbed/libkrun-prefix.tgz -C "$LIBKRUN_PREFIX" .
 
       - name: Upload testbed
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: kvm-testbed
           path: testbed/
@@ -193,7 +195,7 @@ jobs:
         # PR branches restore but never write: multi-GB caches written by
         # every branch LRU-evict the main entries all PRs restore from.
         if: github.ref == 'refs/heads/main' && steps.cargo-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: |
             ~/.cargo/bin/
@@ -213,12 +215,12 @@ jobs:
     runs-on: ubuntu-latest # x86_64; KVM-capable
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Install nextest
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@3d7d7cd5ac7f994c1892ae0c06165095b9139094 # v2
         with:
           tool: nextest
 
@@ -238,7 +240,7 @@ jobs:
           ls -l /dev/kvm
 
       - name: Download testbed
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: kvm-testbed
           path: ${{ runner.temp }}/testbed
@@ -359,7 +361,7 @@ jobs:
 
       - name: Upload guest boot console logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: minvmd-linux-boot-log-x86_64
           path: |

@@ -47,7 +47,7 @@ jobs:
     outputs:
       native: ${{ steps.filter.outputs.native }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Detect relevant changes
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Run core workspace tests
@@ -120,7 +120,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-rust
@@ -139,7 +139,7 @@ jobs:
         # commit; carry it across runs so the e2e isn't dominated by pulls.
         # The e2e script resets XDG_STATE_HOME/XDG_RUNTIME_DIR but leaves
         # XDG_CACHE_HOME alone for exactly this reason.
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.cache/minimal
           key: native-e2e-minimal-cache-${{ hashFiles('.minimal/minimal.toml') }}
@@ -169,7 +169,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-rust
@@ -179,7 +179,7 @@ jobs:
       - name: Install nextest
         # Convention selection is a nextest filterset (binary(/_root_integration$/));
         # cargo test cannot select test targets by pattern.
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@3d7d7cd5ac7f994c1892ae0c06165095b9139094 # v2
         with:
           tool: nextest
       - name: Enable unprivileged user namespaces

@@ -14,6 +14,12 @@ on:
     pull_request:
         branches: ["main"]
     workflow_dispatch:
+    # Reusable so the nightly test tier can run the macOS/HVF e2e on a schedule
+    # (nightly-tests.yml `macos-e2e`). On a scheduled call `github.event_name`
+    # is the caller's event (not `pull_request`), so the lane's internal path
+    # filter is bypassed and the full hypervisor e2e runs. No secrets are used
+    # by this workflow, so the call needs none.
+    workflow_call:
 
 env:
     CARGO_TERM_COLOR: always
@@ -36,7 +42,7 @@ jobs:
         outputs:
             macos: ${{ steps.filter.outputs.macos }}
         steps:
-            - uses: actions/checkout@v7
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
               with:
                   persist-credentials: false
             - name: Detect macOS-relevant changes
@@ -92,17 +98,19 @@ jobs:
               # GitHub-hosted Ubuntu runner. `remove_tool_cache: true`
               # reclaims /opt/hostedtoolcache (~14 GB); the dtolnay Toolchain
               # step below reinstalls the Rust toolchain we actually need.
-              uses: endersonmenezes/free-disk-space@v3 # Use @main for latest, @v3 for stable
+              uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3
               with:
                   remove_android: true
                   remove_dotnet: true
                   remove_haskell: true
                   remove_tool_cache: true
-            - uses: actions/checkout@v7
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
               with:
                   persist-credentials: false
             - name: Toolchain
-              uses: dtolnay/rust-toolchain@stable
+              uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+              with:
+                  toolchain: stable
             - name: Install protoc
               run: sudo sh -c 'apt-get update && apt-get install -y protobuf-compiler'
             - name: Cache cargo + build artifacts (incl. the aarch64 cross target)
@@ -111,7 +119,7 @@ jobs:
               # is incremental after the first run. Restore-only here; the save
               # half (main only) runs at the end of the job.
               id: stage2-cache
-              uses: actions/cache/restore@v6
+              uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
               with:
                   path: |
                       ~/.cargo/bin/
@@ -136,7 +144,7 @@ jobs:
                   arch: aarch64
                   channel: unstable
             - name: Install cross
-              uses: taiki-e/install-action@v2
+              uses: taiki-e/install-action@3d7d7cd5ac7f994c1892ae0c06165095b9139094 # v2
               with:
                   tool: cross
             - name: Build guest initramfs (minimald as /init)
@@ -145,19 +153,19 @@ jobs:
               # not baked into the rootfs.
               run: ./scripts/build-initramfs.sh "$RUNNER_TEMP/initramfs.cpio"
             - name: Upload kernel artifact
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: virtio-kernel-aarch64
                   path: ${{ runner.temp }}/vmlinuz
                   if-no-files-found: error
             - name: Upload rootfs artifact
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: minvmd-rootfs-aarch64
                   path: ${{ runner.temp }}/rootfs.img
                   if-no-files-found: error
             - name: Upload initramfs artifact
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: minimald-initramfs-aarch64
                   path: ${{ runner.temp }}/initramfs.cpio
@@ -166,7 +174,7 @@ jobs:
               # PR branches restore but never write: multi-GB caches written by
               # every branch LRU-evict the main entries all PRs restore from.
               if: github.ref == 'refs/heads/main' && steps.stage2-cache.outputs.cache-hit != 'true'
-              uses: actions/cache/save@v6
+              uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
               with:
                   path: |
                       ~/.cargo/bin/
@@ -207,31 +215,31 @@ jobs:
         runs-on: [self-hosted, macOS, ARM64]
         timeout-minutes: 30
         steps:
-            - uses: actions/checkout@v7
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
               with:
                   persist-credentials: false
             - name: Download virtio-linux kernel
-              uses: actions/download-artifact@v8
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
               with:
                   name: virtio-kernel-aarch64
                   path: ${{ runner.temp }}/kernel
             - name: Download minvmd-rootfs image
-              uses: actions/download-artifact@v8
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
               with:
                   name: minvmd-rootfs-aarch64
                   path: ${{ runner.temp }}/rootfs
             - name: Download guest initramfs
-              uses: actions/download-artifact@v8
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
               with:
                   name: minimald-initramfs-aarch64
                   path: ${{ runner.temp }}/initramfs
             - name: Download darwin testbed
-              uses: actions/download-artifact@v8
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
               with:
                   name: mac-testbed
                   path: ${{ runner.temp }}/testbed
             - name: Install nextest
-              uses: taiki-e/install-action@v2
+              uses: taiki-e/install-action@3d7d7cd5ac7f994c1892ae0c06165095b9139094 # v2
               with:
                   tool: nextest
             - name: Unpack testbed + resolve paths
@@ -378,7 +386,7 @@ jobs:
               # Capture hvc0 output for diagnosing a stuck/failed boot (e.g. a missing
               # virtio driver in the kernel). Always runs so a red boot is debuggable.
               if: always()
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: minvmd-boot-logs
                   path: |
@@ -413,15 +421,16 @@ jobs:
             # sets this on the Linux lanes.
             CARGO_PROFILE_DEV_DEBUG: line-tables-only
         steps:
-            - uses: actions/checkout@v7
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
               with:
                   persist-credentials: false
             - name: Toolchain
-              uses: dtolnay/rust-toolchain@stable
+              uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
               with:
+                  toolchain: stable
                   components: clippy
             - name: Cache cargo registry and build artifacts
-              uses: Swatinem/rust-cache@v2
+              uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
               with:
                   shared-key: mac-unit
                   # PR branches restore but never save, so PR churn cannot
@@ -431,7 +440,7 @@ jobs:
             - name: Provision libkrun (pinned own build)
               uses: ./.github/actions/setup-libkrun-macos
             - name: Install nextest
-              uses: taiki-e/install-action@v2
+              uses: taiki-e/install-action@3d7d7cd5ac7f994c1892ae0c06165095b9139094 # v2
               with:
                   tool: nextest
             - name: Clippy (minvmd)
@@ -502,7 +511,7 @@ jobs:
                   cp "$LIBKRUN_PREFIX/libkrun.1.dylib" testbed/lib/libkrun.1.dylib
                   scripts/rewrite-macos-linkage.sh testbed/bin/minvmd
             - name: Upload darwin testbed
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: mac-testbed
                   path: testbed/