Provide GitHub Actions pinning

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: DeterminateSystems/*
+    commit-message:
+      prefix: ci

.github/workflows/validate.yml

@@ -12,11 +12,17 @@ jobs:
       contents: read
     steps:
       - name: git checkout
-        uses: actions/checkout@v4
-      - uses: DeterminateSystems/determinate-nix-action@v3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - uses: DeterminateSystems/determinate-nix-action@9adf02b41cfdac2632e1c16f0480ff5bf3b05dd6 # v3.21.1
       - uses: DeterminateSystems/flakehub-cache-action@main
-      - run: nix develop -c action-validator -v ./.github/workflows/workflow.yml
-      - run: nix develop -c prettier --check .
+      - name: Validate Action
+        run: nix develop -c action-validator -v ./.github/workflows/workflow.yml
+      - name: Check syntax
+        run: nix develop -c prettier --check .
+      - name: Check GitHub Actions security compliance
+        run: nix develop -c zizmor .github
 
   DeterminateCI:
     uses: ./.github/workflows/workflow.yml

.github/workflows/workflow.yml

@@ -97,12 +97,14 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       # disabled pending strategy discussion on exposing tunables
       # - uses: Determinatesystems/flake-checker-action@main
-      - uses: DeterminateSystems/determinate-nix-action@v3
+      - uses: DeterminateSystems/determinate-nix-action@9adf02b41cfdac2632e1c16f0480ff5bf3b05dd6 # v3.21.1
       - uses: DeterminateSystems/flakehub-cache-action@main
-      - uses: webfactory/ssh-agent@v0.9.0
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         if: ${{ inputs.enable-ssh-agent }}
         with:
           ssh-private-key: ${{ secrets.ssh-private-key }}
@@ -127,14 +129,16 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/determinate-nix-action@v3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - uses: DeterminateSystems/determinate-nix-action@9adf02b41cfdac2632e1c16f0480ff5bf3b05dd6 # v3.21.1
         with:
           extra-conf: |
             extra-experimental-features = provenance
             ${{ inputs.extra-nix-conf }}
       - uses: DeterminateSystems/flakehub-cache-action@main
-      - uses: webfactory/ssh-agent@v0.9.0
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         if: ${{ inputs.enable-ssh-agent }}
         with:
           ssh-private-key: ${{ secrets.ssh-private-key }}
@@ -166,9 +170,11 @@ jobs:
         if: |
           contains(needs.*.result, 'failure') ||
           contains(needs.*.result, 'cancelled')
-      - uses: actions/checkout@main
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         if: ${{ !github.repository.fork && inputs.visibility != '' && (github.ref == format('refs/heads/{0}', inputs.default-branch) || startsWith(github.ref, 'refs/tags/')) }}
-      - uses: DeterminateSystems/determinate-nix-action@v3
+        with:
+          persist-credentials: false
+      - uses: DeterminateSystems/determinate-nix-action@9adf02b41cfdac2632e1c16f0480ff5bf3b05dd6 # v3.21.1
         if: ${{ !github.repository.fork && inputs.visibility != '' && (github.ref == format('refs/heads/{0}', inputs.default-branch) || startsWith(github.ref, 'refs/tags/')) }}
       - uses: DeterminateSystems/flakehub-cache-action@main
         if: ${{ !github.repository.fork && inputs.visibility != '' && (github.ref == format('refs/heads/{0}', inputs.default-branch) || startsWith(github.ref, 'refs/tags/')) }}

.github/zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        DeterminateSystems/*: ref-pin

flake.nix

@@ -1,15 +1,10 @@
 {
-  inputs = {
-    nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/*";
-
-    # For action-validator, which is broken with new rust versions
-    nixpkgs-old.url = "https://flakehub.com/f/NixOS/nixpkgs/0.2411.717196";
-  };
+  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/*";
 
   outputs =
-    { nixpkgs, nixpkgs-old, ... }:
+    { self, ... }@inputs:
     let
-      inherit (nixpkgs) lib;
+      inherit (inputs.nixpkgs) lib;
 
       systems = [
         "aarch64-linux"
@@ -20,27 +15,23 @@
       forEachSystem =
         f:
         lib.genAttrs systems (
-          system:
-          let
-            pkgs = nixpkgs.legacyPackages.${system};
-            pkgs-old = nixpkgs-old.legacyPackages.${system};
-          in
-          f { inherit pkgs pkgs-old; }
+          system: f { pkgs = import inputs.nixpkgs { inherit system; }; }
         );
     in
     {
-
       devShells = forEachSystem (
-        { pkgs, pkgs-old }:
+        { pkgs }:
         {
           default = pkgs.mkShellNoCC {
-            buildInputs = [
-              pkgs.nodePackages.prettier
-
-              pkgs-old.action-validator
+            packages = with pkgs; [
+              action-validator
+              prettier
+              zizmor
             ];
           };
         }
       );
+
+      formatter = forEachSystem ({ pkgs }: pkgs.nixfmt);
     };
 }