Pin all third-party GitHub Actions to commit SHAs

.github/workflows/copilot-setup-steps.yml

@@ -11,29 +11,18 @@ jobs:
       PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }}
       COMMIT_SHA: ${{ github.sha }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: nixbuild/nix-quick-install-action@v30
+      # Shared nix + cachix preamble (checkout, nix-quick-install, Cachix,
+      # cache-nix-action). The third-party action SHAs are pinned once in the
+      # rainix composite.
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
         with:
-          nix_conf: |
-            keep-env-derivations = true
-            keep-outputs = true
-      - uses: cachix/cachix-action@v15
-        continue-on-error: true
-        with:
-          name: rainlanguage
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          useDaemon: false
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v7
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
           gc-max-store-size-linux: 1G
-      - uses: Swatinem/rust-cache@v2
+      - uses: rainlanguage/rainix/.github/actions/rust-cache@main
         with:
           prefix-key: rust-${{ github.workflow }}
       - name: Cache npm
-        uses: actions/cache@v4
+        uses: rainlanguage/rainix/.github/actions/cache@main
         with:
           path: ~/.npm
           key: npm-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('**/package-lock.json') }}

.github/workflows/deploy-subgraph.yaml

@@ -11,25 +11,17 @@ jobs:
       GOLDSKY_TOKEN: ${{ secrets.CI_GOLDSKY_TOKEN }}
       GOLDSKY_SUBGRAPH_NAME: raindex
     steps:
-      - uses: actions/checkout@v4
+      - uses: rainlanguage/rainix/.github/actions/checkout@main
       - name: Free disk space
-        uses: jlumbroso/free-disk-space@v1.3.1
-      - uses: nixbuild/nix-quick-install-action@v30
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      # Shared nix + cachix preamble (nix-quick-install, Cachix,
+      # cache-nix-action). The third-party action SHAs are pinned once in the
+      # rainix composite. checkout: false because free-disk-space runs between
+      # the checkout above and nix-quick-install.
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
         with:
-          nix_conf: |
-            keep-env-derivations = true
-            keep-outputs = true
-      - uses: cachix/cachix-action@v15
-        continue-on-error: true
-        with:
-          name: rainlanguage
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          useDaemon: false
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v6
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
+          checkout: false
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
           gc-max-store-size-linux: 1G
       # subgraph-deploy builds from the committed subgraph/abis + subgraph/generated,
       # so it needs no forge build and runs on the slim subgraph shell.

.github/workflows/manual-rs-release.yml

@@ -7,28 +7,12 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: nixbuild/nix-quick-install-action@v30
+      # Shared nix + cachix preamble (checkout, nix-quick-install, Cachix,
+      # cache-nix-action). The third-party action SHAs are pinned once in the
+      # rainix composite.
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
         with:
-          nix_conf: |
-            keep-env-derivations = true
-            keep-outputs = true
-      - uses: cachix/cachix-action@v15
-        continue-on-error: true
-        with:
-          name: rainlanguage
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          useDaemon: false
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v6
-        with:
-          # restore and save a cache using this key
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          # if there's no cache hit, restore a cache by this prefix
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          # collect garbage until the Nix store size (in bytes) is at most this number
-          # before trying to save a new cache
-          # 1G = 1073741824
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
           gc-max-store-size-linux: 1G
       - run: nix develop .#rust-shell --command cargo release --workspace
       # forwards status to telegram chat if this ci fails or gets canceled, only runs for default branch

.github/workflows/npm-package-release.yml

@@ -28,47 +28,34 @@ jobs:
       version: ${{ env.NEW_VERSION }}
     steps:
       # checkout with SSH key to allow pushing version bump commits back to repo
-      - uses: actions/checkout@v4
+      - uses: rainlanguage/rainix/.github/actions/checkout@main
         with:
           ssh-key: ${{ secrets.PUBLISH_PRIVATE_KEY }}
       # WASM builds require significant disk space; free up space to prevent build failures
       - name: Free disk space
-        uses: jlumbroso/free-disk-space@v1.3.1
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           swap-storage: false
-      # install nix for building WASM artifacts and running tests
-      - uses: nixbuild/nix-quick-install-action@v30
+      # Shared nix + cachix preamble (nix-quick-install, Cachix,
+      # cache-nix-action). The third-party action SHAs are pinned once in the
+      # rainix composite. checkout: false because the ssh-key checkout above and
+      # free-disk-space both run before nix-quick-install.
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
         with:
-          nix_conf: |
-            keep-env-derivations = true
-            keep-outputs = true
-      # pull rainix derivations from shared Cachix; push new ones if the
-      # token is set. continue-on-error so a token miss / Cachix outage
-      # degrades gracefully.
-      - uses: cachix/cachix-action@v15
-        continue-on-error: true
-        with:
-          name: rainlanguage
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          useDaemon: false
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v7
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          gc-max-store-size-linux: 8G
-      - uses: Swatinem/rust-cache@v2
+          checkout: false
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - uses: rainlanguage/rainix/.github/actions/rust-cache@main
         with:
           prefix-key: rust-${{ github.workflow }}
       - name: Cache npm
-        uses: actions/cache@v4
+        uses: rainlanguage/rainix/.github/actions/cache@main
         with:
           path: ~/.npm
           key: npm-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('**/package-lock.json') }}
           restore-keys: npm-${{ runner.os }}-
       # setup node with npm registry for OIDC-based publishing (no NPM_TOKEN needed)
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24.x"
           registry-url: "https://registry.npmjs.org"
@@ -262,19 +249,18 @@ jobs:
           git push -u origin "npm-raindex-v${{ env.RAINDEX_NEW_VERSION }}-uc-v${{ env.UC_NEW_VERSION }}"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      # Create gitHub release with tarballs
+      # Create gitHub release with tarballs. The softprops/action-gh-release SHA
+      # is pinned once in the rainix composite.
       - name: Create GitHub Release
         if: ${{ env.OLD_HASH != env.NEW_HASH }}
-        id: gh_release
-        uses: softprops/action-gh-release@v2
+        uses: rainlanguage/rainix/.github/actions/gh-release@main
         with:
-          tag_name: npm-raindex-v${{ env.RAINDEX_NEW_VERSION }}-uc-v${{ env.UC_NEW_VERSION }}
+          tag-name: npm-raindex-v${{ env.RAINDEX_NEW_VERSION }}-uc-v${{ env.UC_NEW_VERSION }}
           name: NPM Package Release raindex v${{ env.RAINDEX_NEW_VERSION }} ui-components v${{ env.UC_NEW_VERSION }}
           files: |
             raindex_npm_package_${{ env.RAINDEX_NEW_VERSION }}.tgz
             ui_components_npm_package_${{ env.UC_NEW_VERSION }}.tgz
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
       # forwards status to telegram chat if this ci fails or gets canceled, only runs for default branch
       - name: Forward CI Status
         if: always()

.github/workflows/test-js-bindings.yaml

@@ -6,31 +6,22 @@ jobs:
     env:
       COMMIT_SHA: ${{ github.sha }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: rainlanguage/rainix/.github/actions/checkout@main
       - name: Free disk space
-        uses: jlumbroso/free-disk-space@v1.3.1
-      - uses: nixbuild/nix-quick-install-action@v30
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      # Shared nix + cachix preamble (nix-quick-install, Cachix,
+      # cache-nix-action). The third-party action SHAs are pinned once in the
+      # rainix composite. checkout: false because free-disk-space runs between
+      # the checkout above and nix-quick-install.
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
         with:
-          nix_conf: |
-            keep-env-derivations = true
-            keep-outputs = true
-      - uses: cachix/cachix-action@v15
-        continue-on-error: true
-        with:
-          name: rainlanguage
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          useDaemon: false
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v7
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          gc-max-store-size-linux: 8G
-      - uses: Swatinem/rust-cache@v2
+          checkout: false
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - uses: rainlanguage/rainix/.github/actions/rust-cache@main
         with:
           prefix-key: rust-${{ github.workflow }}
       - name: Cache npm
-        uses: actions/cache@v4
+        uses: rainlanguage/rainix/.github/actions/cache@main
         with:
           path: ~/.npm
           key: npm-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('**/package-lock.json') }}

.github/workflows/test-ui-components.yaml

@@ -16,30 +16,17 @@ jobs:
     env:
       COMMIT_SHA: ${{ github.sha }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: rainlanguage/rainix/.github/actions/checkout@main
       - name: Free disk space
-        uses: jlumbroso/free-disk-space@v1.3.1
-      - uses: nixbuild/nix-quick-install-action@v30
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      # Shared nix + cachix preamble (nix-quick-install, Cachix,
+      # cache-nix-action). The third-party action SHAs are pinned once in the
+      # rainix composite. checkout: false because free-disk-space runs between
+      # the checkout above and nix-quick-install.
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
         with:
-          nix_conf: |
-            keep-env-derivations = true
-            keep-outputs = true
-      - uses: cachix/cachix-action@v15
-        continue-on-error: true
-        with:
-          name: rainlanguage
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          useDaemon: false
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v6
-        with:
-          # restore and save a cache using this key
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          # if there's no cache hit, restore a cache by this prefix
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          # collect garbage until the Nix store size (in bytes) is at most this number
-          # before trying to save a new cache
-          # 1G = 1073741824
+          checkout: false
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
           gc-max-store-size-linux: 10G
       - run: |
           nix develop .#wasm-shell -c bash -c '

.github/workflows/test-webapp.yaml

@@ -16,30 +16,17 @@ jobs:
     env:
       COMMIT_SHA: ${{ github.sha }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: rainlanguage/rainix/.github/actions/checkout@main
       - name: Free disk space
-        uses: jlumbroso/free-disk-space@v1.3.1
-      - uses: nixbuild/nix-quick-install-action@v30
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      # Shared nix + cachix preamble (nix-quick-install, Cachix,
+      # cache-nix-action). The third-party action SHAs are pinned once in the
+      # rainix composite. checkout: false because free-disk-space runs between
+      # the checkout above and nix-quick-install.
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
         with:
-          nix_conf: |
-            keep-env-derivations = true
-            keep-outputs = true
-      - uses: cachix/cachix-action@v15
-        continue-on-error: true
-        with:
-          name: rainlanguage
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          useDaemon: false
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v6
-        with:
-          # restore and save a cache using this key
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          # if there's no cache hit, restore a cache by this prefix
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          # collect garbage until the Nix store size (in bytes) is at most this number
-          # before trying to save a new cache
-          # 1G = 1073741824
+          checkout: false
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
           gc-max-store-size-linux: 10G
       - run: |
           nix develop .#wasm-shell -c bash -c '

.github/workflows/vercel-docs-preview.yaml

@@ -18,35 +18,24 @@ jobs:
     env:
       COMMIT_SHA: ${{ github.sha }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: rainlanguage/rainix/.github/actions/checkout@main
       - name: Free disk space
-        uses: jlumbroso/free-disk-space@v1.3.1
-      - uses: nixbuild/nix-quick-install-action@v30
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      # Shared nix + cachix preamble (nix-quick-install, Cachix,
+      # cache-nix-action). The third-party action SHAs are pinned once in the
+      # rainix composite. checkout: false because free-disk-space runs between
+      # the checkout above and nix-quick-install.
+      - uses: rainlanguage/rainix/.github/actions/nix-cachix-setup@main
         with:
-          nix_conf: |
-            keep-env-derivations = true
-            keep-outputs = true
-      - uses: cachix/cachix-action@v15
-        continue-on-error: true
-        with:
-          name: rainlanguage
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          useDaemon: false
-      - name: Restore and save Nix store
-        uses: nix-community/cache-nix-action@v7
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          gc-max-store-size-linux: 8G
-      - uses: Swatinem/rust-cache@v2
+          checkout: false
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - uses: rainlanguage/rainix/.github/actions/rust-cache@main
         with:
           # Restore this branch's own cache if it has one, else fall back to the
-          # cache the prod run saves on main (shared prefix-key). save-if keeps
-          # this branch's cache warm across re-runs.
+          # cache the prod run saves on main (shared prefix-key).
           prefix-key: rust-vercel-docs
-          save-if: true
       - name: Cache npm
-        uses: actions/cache@v4
+        uses: rainlanguage/rainix/.github/actions/cache@main
         with:
           path: ~/.npm
           key: npm-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('**/package-lock.json') }}