From d1d00d6472ab06230d3948b11a337a2faa4b3b6e Mon Sep 17 00:00:00 2001
From: sechmachine <97589681+sechmachine727@users.noreply.github.com>
Date: Thu, 30 Jul 2026 18:33:35 +0700
Subject: [PATCH] ci: pin Protocol verification actions

---
 .gitea/workflows/verify.yml |  6 +++---
 Makefile                    |  7 +++++--
 tools/check_ci_actions.py   | 19 +++++++++++++++++++
 3 files changed, 27 insertions(+), 5 deletions(-)
 create mode 100644 tools/check_ci_actions.py

diff --git a/.gitea/workflows/verify.yml b/.gitea/workflows/verify.yml
index 9fefb1e..4622606 100644
--- a/.gitea/workflows/verify.yml
+++ b/.gitea/workflows/verify.yml
@@ -20,8 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: "1.26.5"
           cache: true
@@ -44,7 +44,7 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Assert pinned toolchain
         shell: bash
         run: |
diff --git a/Makefile b/Makefile
index 805f141..adf5c45 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: verify generate proto-lint proto-breaking source-verify scope-verify conformance frame-verify go-test binding-compile strict-contracts clean-generated
+.PHONY: verify generate proto-lint proto-breaking source-verify scope-verify ci-verify conformance frame-verify go-test binding-compile strict-contracts clean-generated
 
 PYTHON ?= python3
 PROTOC ?= protoc
@@ -23,6 +23,9 @@ scope-verify:
 	$(PYTHON) -B tools/test_check_scope.py
 	$(PYTHON) -B tools/check_scope.py
 
+ci-verify:
+	$(PYTHON) -B tools/check_ci_actions.py
+
 go-test:
 	go test ./gen/go/... ./tests/go
 
@@ -45,4 +48,4 @@ frame-verify:
 clean-generated:
 	$(PYTHON) tools/generate.py --check
 
-verify: generate proto-lint proto-breaking source-verify scope-verify go-test binding-compile strict-contracts conformance frame-verify clean-generated
+verify: generate proto-lint proto-breaking source-verify scope-verify ci-verify go-test binding-compile strict-contracts conformance frame-verify clean-generated
diff --git a/tools/check_ci_actions.py b/tools/check_ci_actions.py
new file mode 100644
index 0000000..e5dd9d6
--- /dev/null
+++ b/tools/check_ci_actions.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+"""Require immutable commits for third-party Gitea workflow actions."""
+
+from __future__ import annotations
+
+import pathlib
+import re
+
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+USE = re.compile(r"^\s*-\s+uses:\s+([^@\s]+)@([^\s#]+)", re.MULTILINE)
+
+
+for workflow in sorted((ROOT / ".gitea/workflows").glob("*.y*ml")):
+    for action, revision in USE.findall(workflow.read_text(encoding="utf-8")):
+        if not action.startswith("./") and not re.fullmatch(r"[0-9a-f]{40}", revision):
+            raise SystemExit(f"{workflow.relative_to(ROOT)}: mutable action {action}@{revision}")
+
+print("Protocol CI action references are immutable")