CI: Bump every action pin to its latest release #74

Summary

Move every uses: pin and every allow-list pin in this repository to the latest tagged release, now, rather than waiting out the seven-day Dependabot cooldown, so the pins embedded in these reusable workflows stop failing the jobs that call them. node-workflows#222 is the same request for the Node lanes; this one covers docs-workflows.

On main at caa803d the two pins that drive the current CI failures are already right: every step-security/harden-runner reference is at v2.22.3 (#65, the release that survives GitHub's westus2 DNS experiment, see node-workflows#205) and every lfreleng-actions/harden-runner-block-action reference in a workflow is at v0.14.0, which waits for the agent before the first network step. They must stay there: node-workflows#218 shows Dependabot can propose a downgrade (v2.22.3 back to v2.22.2) when its metadata lags a bump made another way, so any such pull request here should be closed, not merged.

What is behind: eight coordinates in the workflows and examples, and two pins in docs/DOCS_WORKFLOWS_BRIEF.md that still show a snippet from June (loader v0.2.1, allow-list v0.1.1). The other thirteen coordinates are at their latest release and stay as they are.

Change required

For each row, replace every occurrence of the old SHA with the new one and update the trailing version comment, keeping each file's existing comment spacing ( # vX.Y.Z in workflows). Every new SHA below is a commit SHA, checked on 2026-10-29 against the refs API (annotated tags dereferenced to their commits), so no tag-object SHA is introduced.

The allow-list pin appears in three forms in the workflows, all of which move: the harden_runner_allowlist input defaults in docs-build.yaml and docs-audit.yaml (lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@<sha>), and config: '@<sha>' in release-drafter.yaml. Between v0.17.2 and v0.19.0 the shared list replaces the suspended aswf.jfrog.io with linuxfoundation.jfrog.io; nothing a documentation lane connects to (readthedocs.org, PyPI, files.pythonhosted.org, the link-check targets) is removed.

In docs/DOCS_WORKFLOWS_BRIEF.md, the harden-runner snippet under "The harden-runner pattern from python-workflows" and the allow-list path under "The allow-list default points at a pinned path" move to the pins above; the sentence after the path gives the file's line count, which at v0.19.0 is 796, so update the count with the pin. The rest of the brief's prose describes the design and stays.

Files touched, with the number of references that change in each:

Compatibility, checked against each release's action.yaml: checkout-gerrit-change-action v1.2.1 adds the optional on-unavailable input and a checked-out output and changes nothing this repository passes; gerrit-review-action v1.2.0 adds an optional message input and keeps host, username, key, gerrit-change-number, gerrit-patchset-number and vote-type, which are the inputs the examples pass; the two generic-workflows callers and the openssf-scorecard.yaml caller change no inputs; setup-uv v10.3.3 is a patch release. No with: block needs editing.

Leave alone: the all-zero placeholder pins in examples/*/github.yaml and examples/docs-build/gerrit*.yaml (docs-workflows/.github/workflows/*.yaml@0000…, marked REPLACE: vX.Y.Z, which stand for the version a consumer picks), and every coordinate already at its latest release (step-security/harden-runner v2.22.3, harden-runner-block-action v0.14.0 in the workflows, actions/checkout v7.0.1, actions/setup-python v7.1.0, rtd-build-action v0.0.3, rtd-config-audit-action v0.1.2, tox-run-action v0.2.0, im-open/workflow-conclusion v3.0.0, tlylt/install-graphviz v1.0.0, release-drafter v7.10.0).

One commit is enough; a subject such as CI: Bump every action pin to its latest release fits the gitlint title limit.

Acceptance

• No old SHA from the table remains anywhere under .github/, examples/ or docs/.
• grep -rn 'step-security/harden-runner@' . still shows only 46b06cea… (v2.22.3), and grep -rn 'harden-runner-block-action@' . only e5e8179f… (v0.14.0).
• prek run --files <changed files> passes (actionlint, yamllint, zizmor, markdownlint and the workflow schema hooks run here).
• zizmor --persona auditor .github/workflows/ reports zero findings.
• Testing 🧪 passes on the pull request.

Why not wait for Dependabot

The cooldown in .github/dependabot.yml is seven days, and Dependabot proposes one coordinate per pull request, so the eight bumps would arrive as eight pull requests over the coming week, and the consumers of these reusable workflows only benefit once a release of this repository carries the pins. One pull request moving everything at once, followed by a release, is the shortest path. The cooldown also does not stop a stale downgrade, as node-workflows#218 showed.

References

• CI: Bump step-security/harden-runner to v2.22.3 #64 / CI: Bump step-security/harden-runner to v2.22.3 #65: the harden-runner bump to v2.22.3 in this repository.
• node-workflows#222: the same bump for the Node lanes, and node-workflows#218, the Dependabot downgrade to avoid here.
• rust-workflows#29, java-workflows#114: the harden-runner-block-action v0.14.0 bump and the start-up race it closes.