Harden CI's security posture

.github/actions/check-rebuild/action.yml

@@ -13,15 +13,21 @@ runs:
   steps:
     - name: "Build"
       shell: bash
-      run: ${{ inputs.command }}
+      run: bash -c -- "$INPUTS_COMMAND"
+      env:
+        INPUTS_COMMAND: ${{ inputs.command }}
     - name: "Verify rebuild is a no-op"
       shell: bash
       run: |
-        stale=$(${{ inputs.command }} \
-          ${{ inputs.message-format-flag }} json 2>/dev/null \
+        verify_command=${INPUTS_COMMAND}' "$@"'
+        stale=$(bash -c -- "$verify_command" _ \
+          "$INPUTS_MESSAGE_FORMAT_FLAG" json 2>/dev/null \
           | jq -r 'select(.reason == "compiler-artifact" and .fresh == false) | .target.name')
         if [ -n "$stale" ]; then
           echo "ERROR: Rebuild recompiled crates that should have been cached:"
           echo "$stale"
           exit 1
         fi
+      env:
+        INPUTS_COMMAND: ${{ inputs.command }}
+        INPUTS_MESSAGE_FORMAT_FLAG: ${{ inputs.message-format-flag }}

.github/actions/setup-flatc/action.yml

@@ -11,6 +11,8 @@ runs:
       id: download-flatc
       shell: bash
       run: |
-        wget -O /tmp/flatc.zip "https://github.com/google/flatbuffers/releases/download/v${{ inputs.flatc_version }}/Linux.flatc.binary.clang++-18.zip"
+        wget -O /tmp/flatc.zip "https://github.com/google/flatbuffers/releases/download/v${INPUTS_FLATC_VERSION}/Linux.flatc.binary.clang++-18.zip"
         unzip /tmp/flatc.zip flatc
         mv flatc /usr/local/bin/
+      env:
+        INPUTS_FLATC_VERSION: ${{ inputs.flatc_version }}

.github/actions/setup-protoc/action.yml

@@ -25,7 +25,7 @@ runs:
           esac
         fi
 
-        PROTOC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v${{ inputs.protoc_version }}/protoc-${{ inputs.protoc_version }}-${PROTOC_ARCH}.zip"
+        PROTOC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v${INPUTS_PROTOC_VERSION}/protoc-${INPUTS_PROTOC_VERSION}-${PROTOC_ARCH}.zip"
         wget -q -O /tmp/protoc.zip "$PROTOC_URL"
         unzip -o /tmp/protoc.zip -d /tmp/protoc
 
@@ -41,3 +41,5 @@ runs:
 
         rm -rf /tmp/protoc.zip /tmp/protoc
         protoc --version
+      env:
+        INPUTS_PROTOC_VERSION: ${{ inputs.protoc_version }}

.github/actions/setup-rust/action.yml

@@ -45,7 +45,7 @@ runs:
 
     - name: Rust Toolchain
       id: rust-toolchain
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4  # stable
+      uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
       if: steps.check-rustup.outputs.exists != 'true'
       with:
         toolchain: "${{ steps.toolchain-config.outputs.toolchain }}"

.github/actions/upload-parca-debuginfo/action.yml

@@ -54,8 +54,6 @@ runs:
           chmod +x parca-debuginfo
         fi
 
-        echo "$PWD" >> "$GITHUB_PATH"
-
     - name: Upload benchmark binary debuginfo to Polar Signals
       shell: bash
       env:
@@ -84,7 +82,7 @@ runs:
           fi
 
           cmd=(
-            parca-debuginfo
+            "$RUNNER_TEMP/parca-debuginfo/parca-debuginfo"
             upload
             "--store-address=$STORE_ADDRESS"
             "--bearer-token-file=$token_file"