fix(ci): harden GitHub Actions workflows (#1138)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #1138.

Targets main. Files changed:

• .github/workflows/discovery-catalog.yml

Findings addressed:

• HIGH unpinned-action (pinact) — .github/workflows/discovery-catalog.yml:29
• HIGH unpinned-action (pinact) — .github/workflows/discovery-catalog.yml:30
• HIGH unpinned-action (pinact) — .github/workflows/discovery-catalog.yml:51

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

Closes huggingface/tracking-issues#937

---

Note

Low Risk
CI-only mechanical pinning with no application or runtime behavior changes.

Overview
Hardens the Discovery catalog workflow by replacing floating action version tags with immutable commit SHAs for actions/checkout, astral-sh/setup-uv, and actions/upload-artifact (with version comments preserved for readability).

This addresses unpinned-action findings from pinact; job steps, env vars, and catalog build logic are unchanged.

^{Reviewed by Cursor Bugbot for commit 09377d1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[paulinebm]

LGTM

[cursor]

Alignment Review Report

PR #1161 — fix(ci): harden GitHub Actions workflows (#1138) pins three third-party Actions in .github/workflows/discovery-catalog.yml to full-length commit SHAs (with version comments). Scope: 1 file, +3/−3, no Python/library code touched.

Automated Checks

• Lint: PASS (for this diff). .claude/hooks/lint.sh reports ruff format drift, but only in pre-existing envs/** Python files (e.g. opencode_env, pi_env, chat_env, …). This PR changes zero .py files, so it introduces no lint regression. (uv was absent in the review env and had to be installed to run the hook.)
• Debug code: CLEAN (for this diff). .claude/hooks/check-debug.sh flags only pre-existing print/TODO occurrences under src/; none are in the changed workflow.
• YAML validity: discovery-catalog.yml parses cleanly.
• Supply-chain pin verification (the core of this change): all three pinned SHAs match their claimed upstream tags on the canonical official repos (verified via git ls-remote --tags):

Action	Pinned SHA	Comment	Verified
actions/checkout	3d3c42e5…ba90b1	# v7.0.1	✅ refs/tags/v7.0.1
astral-sh/setup-uv	37802adc…1f3b78	# v7.6.0	✅ refs/tags/v7.6.0
actions/upload-artifact	ea165f8d…07fa02	# v4.6.2	✅ refs/tags/v4.6.2

The workflow also already sets least-privilege permissions: contents: read and passes context values through env: rather than interpolating them into run: scripts — no script-injection surface.

Open RFCs Context

• RFC 011 – ARD Catalog Discovery (Draft) — this workflow (added in #1138) implements RFC 011's discovery-catalog snapshot. This PR only hardens CI action pinning; it does not alter discovery schema, CLI, or logic, so there is no conflict with RFC 011 — it supports it. Domain owner for context: @thegovind.
• No other Draft/In-Review RFC (000/001/002/003/005/008 In Review, 010 Draft) touches CI; none are affected.

Tier 1: Fixes Required

• None. No Python changed (no lint/debug regressions), YAML is valid, and all three action pins verify against upstream tags. No credential exposure or injection surface — this change improves security.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. A CI action-pinning change does not touch any OpenEnv design principle or invariant (Gymnasium API signatures, MCP/agent boundary, rewards-in-environment, client-server separation, agents-cannot-reset).

RFC Conflicts

None identified. See RFC 011 context above — the change supports rather than conflicts with the RFC-011 workflow.

Optional (non-blocking) notes

• Repo-wide consistency (out of scope here): 8 other workflows still reference mutable tags — test.yml, docker-build.yml, openspiel_base_build.yml, package-ci.yml, deploy-hf-env.yml, manage-hf-collection.yml, publish-pypi.yml, publish-testpypi.yml. A follow-up applying the same SHA-pinning would make the hardening uniform. Separately, publish-pypi.yml / publish-testpypi.yml reference actions/upload-artifact@v7 and actions/download-artifact@v8, which look like incorrect majors (these actions currently top out at v4) — pre-existing, worth a separate look.
• Optional extra hardening: actions/checkout could set persist-credentials: false, since the job performs no authenticated git operations after checkout.

Summary

• 0 mechanical issues to fix (Tier 1)
• 0 alignment points for human review (Tier 2)
• 0 RFC conflicts
• Verdict: Clean, correctly-scoped supply-chain hardening; all three pins independently verified against upstream tags. Optional follow-ups above are non-blocking.

  

_{Sent by Cursor Automation: Pre-review}