ci: align GitHub Actions with server SHAs, delegate pinning enforcement to native policy

.github/workflows/main.yaml

@@ -28,7 +28,7 @@ jobs:
       dry-run: ${{ steps.check-dry-run.outputs.enabled }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 2
 
@@ -66,10 +66,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-
-      - name: Lint pinned actions
-        run: bash tools/linter_actions_pinned.sh
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Get list of changed C# files
         id: changed-files
@@ -155,15 +152,15 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup .NET
         uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
 
       - name: Download all coverage artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: coverage-*
           path: ./all-coverage
@@ -181,7 +178,7 @@ jobs:
             -title:"Weaviate C# Client Coverage"
 
       - name: Upload HTML coverage report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: coverage-report-html
           path: ./coveragereport
@@ -196,7 +193,7 @@ jobs:
           path: ./coveragereport/SummaryGithub.md
 
       - name: Download all test results
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         continue-on-error: true
         with:
           pattern: test-results-*
@@ -239,7 +236,7 @@ jobs:
           if [ -z "${{ secrets.NUGET_APIKEY }}" ]; then echo "Warning: NUGET_APIKEY is not set"; fi
 
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           fetch-tags: true

.github/workflows/pr-security-lint.yaml

@@ -16,7 +16,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout base branch
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ github.event.pull_request.base.sha }}
 

.github/workflows/test-on-weaviate-version.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup .NET
         uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
@@ -62,7 +62,7 @@ jobs:
           fi
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         if: ${{ !github.event.pull_request.head.repo.fork && github.triggering_actor != 'dependabot[bot]' }}
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -123,15 +123,15 @@ jobs:
         run: /bin/bash ci/stop_weaviate.sh ${{ inputs.weaviate-version }}
 
       - name: Upload test results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: failure()
         with:
           name: test-results-integration-${{ inputs.weaviate-version }}
           path: ./test-results/*.trx
           retention-days: 7
 
       - name: Upload coverage data
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: always()
         with:
           name: coverage-integration-${{ inputs.weaviate-version }}

src/Weaviate.Client.Tests/Integration/TestRbacAuthorization.cs

@@ -7,23 +7,8 @@ namespace Weaviate.Client.Tests.Integration;
 /// <summary>
 /// RBAC Groups integration tests (Rest:8092 gRPC:50063). Authorization checks for various operations.
 /// </summary>
-public class TestRbacAuthorization : IntegrationTests
+public class TestRbacAuthorization : RbacIntegrationTests
 {
-    /// <summary>
-    /// Gets the value of the rest port
-    /// </summary>
-    public override ushort RestPort => 8092;
-
-    /// <summary>
-    /// Gets the value of the grpc port
-    /// </summary>
-    public override ushort GrpcPort => 50063;
-
-    /// <summary>
-    /// The admin api key
-    /// </summary>
-    private const string ADMIN_API_KEY = "admin-key";
-
     /// <summary>
     /// Initializes this instance
     /// </summary>
@@ -35,11 +20,6 @@ public override async ValueTask InitializeAsync()
         RequireVersion("1.32.0");
     }
 
-    /// <summary>
-    /// Gets the value of the credentials
-    /// </summary>
-    public override ICredentials? Credentials => Auth.ApiKey(ADMIN_API_KEY);
-
     /// <summary>
     /// Tests that test authorization failure
     /// </summary>

src/Weaviate.Client.Tests/Integration/TestRbacGroups.cs

@@ -8,23 +8,8 @@ namespace Weaviate.Client.Tests.Integration;
 /// RBAC Groups integration tests (Rest:8092 gRPC:50063). Groups functionality is limited; these
 /// tests mainly exercise listing groups and fetching their role assignments.
 /// </summary>
-public class TestRbacGroups : IntegrationTests
+public class TestRbacGroups : RbacIntegrationTests
 {
-    /// <summary>
-    /// Gets the value of the rest port
-    /// </summary>
-    public override ushort RestPort => 8092;
-
-    /// <summary>
-    /// Gets the value of the grpc port
-    /// </summary>
-    public override ushort GrpcPort => 50063;
-
-    /// <summary>
-    /// The admin api key
-    /// </summary>
-    private const string ADMIN_API_KEY = "admin-key";
-
     /// <summary>
     /// Initializes this instance
     /// </summary>
@@ -36,11 +21,6 @@ public override async ValueTask InitializeAsync()
         RequireVersion("1.32.0");
     }
 
-    /// <summary>
-    /// Gets the value of the credentials
-    /// </summary>
-    public override ICredentials? Credentials => Auth.ApiKey(ADMIN_API_KEY);
-
     /// <summary>
     /// Tests that list groups
     /// </summary>

src/Weaviate.Client.Tests/Integration/TestRbacRoles.cs

@@ -11,28 +11,8 @@ namespace Weaviate.Client.Tests.Integration;
 /// </summary>
 /// <seealso cref="IntegrationTests"/>
 [Trait("Category", "RBAC")]
-public class TestRbacRoles : IntegrationTests
+public class TestRbacRoles : RbacIntegrationTests
 {
-    /// <summary>
-    /// Gets the value of the rest port
-    /// </summary>
-    public override ushort RestPort => 8092;
-
-    /// <summary>
-    /// Gets the value of the grpc port
-    /// </summary>
-    public override ushort GrpcPort => 50063;
-
-    /// <summary>
-    /// The admin api key
-    /// </summary>
-    private const string ADMIN_API_KEY = "admin-key";
-
-    /// <summary>
-    /// Gets the value of the credentials
-    /// </summary>
-    public override ICredentials? Credentials => Auth.ApiKey(ADMIN_API_KEY);
-
     /// <summary>
     /// Makes the role name using the specified suffix
     /// </summary>

src/Weaviate.Client.Tests/Integration/TestRbacUsers.cs

@@ -10,28 +10,8 @@ namespace Weaviate.Client.Tests.Integration;
 /// Requires Weaviate with RBAC running on port defined in 8092/50063.
 /// </summary>
 [Trait("Category", "RBAC")]
-public class TestRbacUsers : IntegrationTests
+public class TestRbacUsers : RbacIntegrationTests
 {
-    /// <summary>
-    /// Gets the value of the rest port
-    /// </summary>
-    public override ushort RestPort => 8092;
-
-    /// <summary>
-    /// Gets the value of the grpc port
-    /// </summary>
-    public override ushort GrpcPort => 50063;
-
-    /// <summary>
-    /// The admin api key
-    /// </summary>
-    private const string ADMIN_API_KEY = "admin-key";
-
-    /// <summary>
-    /// Gets the value of the credentials
-    /// </summary>
-    public override ICredentials? Credentials => Auth.ApiKey(ADMIN_API_KEY);
-
     /// <summary>
     /// Initializes this instance
     /// </summary>

src/Weaviate.Client.Tests/Integration/_Integration.cs

@@ -83,12 +83,12 @@ public IntegrationTests()
     /// <summary>
     /// Gets the value of the rest port
     /// </summary>
-    public virtual ushort RestPort => 8080;
+    public virtual ushort RestPort => _configuration.GetValue<ushort>("WV_HTTP_PORT", 8080);
 
     /// <summary>
     /// Gets the value of the grpc port
     /// </summary>
-    public virtual ushort GrpcPort => 50051; // default local gRPC port
+    public virtual ushort GrpcPort => _configuration.GetValue<ushort>("WV_GRPC_PORT", 50051);
 
     /// <summary>
     /// Disposes this instance

src/Weaviate.Client.Tests/Integration/_RbacIntegration.cs

@@ -0,0 +1,25 @@
+namespace Weaviate.Client.Tests.Integration;
+
+using Microsoft.Extensions.Configuration;
+using Weaviate.Client;
+
+/// <summary>
+/// Base class for RBAC integration tests. Connects to the RBAC-enabled Weaviate instance
+/// whose ports are controlled by WV_RBAC_HTTP_PORT / WV_RBAC_GRPC_PORT environment variables
+/// (defaulting to 8092 / 50063 to match the local docker-compose RBAC service).
+/// Use WV_RBAC_HTTP_PORT / WV_RBAC_GRPC_PORT to point these tests at the proxy RBAC endpoint.
+/// </summary>
+public abstract class RbacIntegrationTests : IntegrationTests
+{
+    /// <summary>The API key for the built-in admin user on the RBAC server.</summary>
+    protected const string ADMIN_API_KEY = "admin-key";
+
+    /// <inheritdoc />
+    public override ushort RestPort => _configuration.GetValue<ushort>("WV_RBAC_HTTP_PORT", 8092);
+
+    /// <inheritdoc />
+    public override ushort GrpcPort => _configuration.GetValue<ushort>("WV_RBAC_GRPC_PORT", 50063);
+
+    /// <inheritdoc />
+    public override ICredentials? Credentials => Auth.ApiKey(ADMIN_API_KEY);
+}

src/Weaviate.Client.Tests/Weaviate.Client.Tests.csproj

@@ -28,6 +28,10 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
+    <PackageReference Include="JunitXml.TestLogger" Version="5.0.0">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
     <PackageReference Include="dotenv.net" Version="4.0.0" />
     <PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="9.0.0" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="9.0.0" />

src/Weaviate.Client.Tests/packages.lock.json

@@ -14,6 +14,12 @@
         "resolved": "4.0.0",
         "contentHash": "SM8Qp6L/E3tsLKDFkV23M8WHyp5l1YqsXkylQDjQjV02Z2tUL3J6j1gV0gMs4L6YtoSB7jZPw2dnDdnpEXnpNQ=="
       },
+      "JunitXml.TestLogger": {
+        "type": "Direct",
+        "requested": "[5.0.0, )",
+        "resolved": "5.0.0",
+        "contentHash": "wpmmxsaAmvOylBPMngyjwWdUiG3tu9eouBB9VN/5gbiWvaE6TInbKH8F0IGFIH0zTUaqbx4t4FV1avvC5htpdA=="
+      },
       "Microsoft.Extensions.Configuration.EnvironmentVariables": {
         "type": "Direct",
         "requested": "[9.0.0, )",