fix(ci): harden GitHub Actions workflows (#1179)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #1179.

Targets ben/rfc008-l2-02-docker. Files changed:

• .github/workflows/validation-runtime.yml

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/validation-runtime.yml:18
• HIGH unpinned-action (pinact) — .github/workflows/validation-runtime.yml:22
• HIGH unpinned-action (pinact) — .github/workflows/validation-runtime.yml:25
• HIGH unpinned-action (pinact) — .github/workflows/validation-runtime.yml:45

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

---

Note

Low Risk
Mechanical supply-chain hardening only; no changes to validation logic or secrets handling.

Overview
Pins four third-party GitHub Actions in Validation runtime to immutable commit SHAs (with version comments) instead of floating @v7 / @v4 tags: actions/checkout, actions/setup-python, astral-sh/setup-uv, and actions/upload-artifact.

This addresses unpinned-action findings from workflow hardening (#1179); job steps, Python/uv versions, and validation commands are unchanged.

^{Reviewed by Cursor Bugbot for commit ec3754e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Supply-chain hardening: validation-runtime.yml moves four actions from floating major tags to full commit-SHA pins (each annotated # vX.Y.Z). The substance of this PR is whether every pin authentically matches its claimed tag — it does.

Automated Checks

• Lint: N/A (PASS) — YAML-only diff; the Python-only lint.sh hook doesn't lint .github/workflows/. (uv isn't installed on this review VM, so the hook no-ops immediately — unrelated to this PR.)
• Debug code: CLEAN — check-debug.sh scans src/ only; the pre-existing push.py console.print / CLI TODO hits are not in this diff.
• YAML validity: PASS — validation-runtime.yml parses.
• SHA authenticity (verified against upstream via GitHub API — each SHA dereferences to the exact tag in its comment):

Action	Pinned SHA	Comment	Verified
actions/checkout	3d3c42e5…ba90b1	v7.0.1	✓ v7.0.1
actions/setup-python	5fda3b95…53e4b97	v7.0.0	✓ v7.0.0
astral-sh/setup-uv	37802adc…1f3b78	v7.6.0	✓ v7.6.0
actions/upload-artifact	ea165f8d…07fa02	v4.6.2	✓ v4.6.2

All are full 40-char pins, and each is the latest patch within the same major that was previously floating (@v7/@v7/@v7/@v4) → zero behavioral change, pure supply-chain hardening. The pins are byte-identical to the already-hardened sibling discovery-catalog.yml in this stack, so they're deliberate and consistent.

Open RFCs Context

validation-runtime.yml belongs to the RFC-008 (Environment Auto-Validation, In Review, @zkwentz) Level-2 Docker validation stack (base ben/rfc008-l2-02-docker); the repo also carries RFC-011 (ARD Catalog Discovery, Draft), whose sibling discovery-catalog.yml uses the same pins. No RFC governs CI / GitHub Actions, so this change neither touches nor pre-empts any RFC design surface.

Tier 1: Fixes Required

None. SHAs authentic, comments accurate, majors preserved (no breaking bump), YAML valid.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. Security-positive (SHA pinning mitigates mutable-tag supply-chain risk). permissions: contents: read, persist-credentials: false, and on: pull_request (not pull_request_target) are already in place; no runtime API surface (Gym/MCP/rewards/client-server/container/credentials) is touched.

RFC Conflicts

None identified.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts

Non-blocking FYIs (reviewer @burtenshaw — owns .github/ + dependabot and authored the base stack; cc @zkwentz for RFC-008):

• Scope: the title says "workflows" (plural) but only validation-runtime.yml changed. That's correct for this stack — it now matches the already-pinned discovery-catalog.yml. The rest of the repo (test.yml, package-ci.yml, deploy-hf-env.yml, docker-build.yml, publish-*.yml, manage-hf-collection.yml, openspiel_base_build.yml) still uses floating tags, a natural repo-wide follow-up.
• Maintenance: the github-actions Dependabot updater supports SHA pins and keeps the # vX.Y.Z comment fresh, so these won't silently go stale.
• Minor (pre-existing, out of scope): upload-artifact is pinned to the v4 major here vs. the v7 major in publish-*.yml — a repo-internal inconsistency a future unification pass could resolve.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

✓ Verified authentic: 3d3c42e5aac5ba805825da76410c181273ba90b1 is the commit for actions/checkout tag v7.0.1 (latest v7; confirmed via GitHub API). Full 40-char pin, same major as the prior @v7 → no behavior change. persist-credentials: false is retained. 👍

[cursor]

✓ Verified authentic: 5fda3b95a4ea91299a34e894583c3862153e4b97 = actions/setup-python v7.0.0 (latest v7). Matches the prior @v7 major → no behavior change.

[cursor]

✓ Verified authentic: 37802adc94f370d6bfd71619e3f0bf239e1f3b78 = astral-sh/setup-uv v7.6.0. Keeps the @v7 major used elsewhere (test.yml) and is byte-identical to the sibling discovery-catalog.yml pin. (setup-uv's latest overall is v10, but staying on v7 preserves parity + behavior — good call for a hardening-only PR; leave the major bump to Dependabot.)

[cursor]

✓ Verified authentic: ea165f8d65b6e75b540449e92b4886f43607fa02 = actions/upload-artifact v4.6.2 (latest v4). Same v4 major as before. Note (pre-existing, out of scope): publish-*.yml pin the v7 major of this action — a repo-internal inconsistency for a future unification pass.