Update and pin dependencies

.github/workflows/build_package.yml

@@ -105,7 +105,7 @@ jobs:
       MANYLINUX_AARCH64_IMAGE: quay.io/pypa/manylinux_2_28_aarch64
 
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           path: "c" # Windows can hit path length limits, so use a short path.
           submodules: true
@@ -121,7 +121,7 @@ jobs:
         run: ./c/build_tools/python_deploy/install_windows_deps.ps1
       - name: "Configure MSVC (Windows)"
         if: "matrix.build-family == 'windows'"
-        uses: ilammy/[email protected]
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
 
       ##########################################################################
       # Write version_info.json
@@ -285,7 +285,7 @@ jobs:
             "${MANYLINUX_X86_64_IMAGE}" \
             bash -c 'export PATH=/opt/python/cp39-cp39/bin:$PATH; python ./c/build_tools/github_actions/build_dist.py py-tf-compiler-tools-pkg'
 
-      - uses: actions/upload-artifact@v4.3.3
+      - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: wheels-${{ matrix.build-family }}-${{ matrix.build-package }}
           # We upload all wheels (which includes deps so that subsequent
@@ -312,7 +312,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: "Invoke workflow :: Validate and Publish Release"
-        uses: benc-uk/workflow-dispatch@798e70c97009500150087d30d9f11c5444830385 # v1.2.2
+        uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4
         with:
           workflow: Validate and Publish Release
           token: ${{ secrets.WRITE_ACCESS_TOKEN }}

.github/workflows/bump_torch_mlir.yml

@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout repository
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: false
 
@@ -61,7 +61,7 @@ jobs:
           echo "TORCH_MLIR_COMMIT=$TORCH_MLIR_COMMIT" >> $GITHUB_OUTPUT
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6.0.5
+        uses: peter-evans/create-pull-request@8867c4aba1b742c39f8d0ba35429c2dfa4b6cb20 # v7.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           base: main

.github/workflows/ci.yml

@@ -67,7 +67,7 @@ jobs:
       - os-family=Linux
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: "Building and testing with Bazel"
@@ -107,8 +107,8 @@ jobs:
     env:
       BUILD_DIR: build-runtime
     steps:
-      - uses: actions/[email protected]
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.1.0
         with:
           python-version: "3.11"
 
@@ -121,7 +121,7 @@ jobs:
           echo "CXX=clang++" >> $GITHUB_ENV
       - name: (Windows) Configure MSVC
         if: contains(matrix.name, 'windows')
-        uses: ilammy/[email protected]
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
       - name: (macOS) Install requirements
         if: contains(matrix.name, 'macos')
         run: brew install ninja ccache coreutils bash
@@ -131,7 +131,7 @@ jobs:
       - name: Install Python requirements
         run: pip install -r ./runtime/bindings/python/iree/runtime/build_requirements.txt
       - name: ccache
-        uses: hendrikmuhs/[email protected]
+        uses: hendrikmuhs/ccache-action@ed74d11c0b343532753ecead8a951bb09bb34bc9 # v1.2.14
         with:
           key: ${{ github.job }}-${{ matrix.name }}
           save: ${{ needs.setup.outputs.write-caches == 1 }}
@@ -163,13 +163,13 @@ jobs:
       CC: clang
       CXX: clang++
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Install requirements
         run: sudo apt update && sudo apt install -y ninja-build
       - name: Checkout runtime submodules
         run: bash ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: ccache
-        uses: hendrikmuhs/[email protected]
+        uses: hendrikmuhs/ccache-action@ed74d11c0b343532753ecead8a951bb09bb34bc9 # v1.2.14
         with:
           key: ${{ github.job }}
           save: ${{ needs.setup.outputs.write-caches == 1 }}
@@ -206,13 +206,13 @@ jobs:
       CXX: clang++
       TRACING_PROVIDER: ${{ matrix.provider }}
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Install requirements
         run: sudo apt update && sudo apt install -y ninja-build
       - name: Checkout runtime submodules
         run: bash ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: ccache
-        uses: hendrikmuhs/[email protected]
+        uses: hendrikmuhs/ccache-action@ed74d11c0b343532753ecead8a951bb09bb34bc9 # v1.2.14
         with:
           key: ${{ github.job }}-${{ matrix.provider }}
           save: ${{ needs.setup.outputs.write-caches == 1 }}
@@ -283,7 +283,7 @@ jobs:
   #     IREE_WRITE_REMOTE_CCACHE: ${{ needs.setup.outputs.write-caches }}
   #   steps:
   #     - name: "Checking out repository"
-  #       uses: actions/[email protected]
+  #       uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
   #     - name: "Checking out runtime submodules"
   #       run: ./build_tools/scripts/git/update_runtime_submodules.sh
   #     - name: "Downloading install dir archive"
@@ -341,7 +341,7 @@ jobs:
       # - cross_compile_and_test
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Getting failed jobs
         id: failed_jobs
         run: |
@@ -356,7 +356,7 @@ jobs:
             exit 1
           fi
       - name: Posting to Discord
-        uses: sarisia/[email protected].3
+        uses: sarisia/actions-status-discord@ce8cc68e4e626000136b3c702d049a154243e490 # v1.14.7
         if: failure() && github.ref_name == 'main'
         with:
           webhook: ${{ secrets.DISCORD_WEBHOOK }}

.github/workflows/ci_linux_arm64_clang.yml

@@ -38,7 +38,7 @@ jobs:
       BUILD_DIR: build-arm64
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: "Building IREE"

.github/workflows/ci_linux_x64_clang.yml

@@ -38,7 +38,7 @@ jobs:
       BUILD_DIR: full-build-dir
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: "Building IREE"

.github/workflows/ci_linux_x64_clang_asan.yml

@@ -36,7 +36,7 @@ jobs:
       - os-family=Linux
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: "Building and testing with ASan"

.github/workflows/ci_linux_x64_clang_byollvm.yml

@@ -34,7 +34,7 @@ jobs:
         shell: bash
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: "Building and testing with bring-your-own-LLVM"

.github/workflows/ci_linux_x64_clang_debug.yml

@@ -47,7 +47,7 @@ jobs:
       BUILD_DIR: build-debug
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: Install Python requirements

.github/workflows/ci_linux_x64_clang_tsan.yml

@@ -39,7 +39,7 @@ jobs:
       - os-family=Linux
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: "Building and testing with TSan"

.github/workflows/ci_linux_x64_gcc.yml

@@ -36,7 +36,7 @@ jobs:
       BUILD_DIR: build-gcc
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: "Building IREE with gcc"

.github/workflows/ci_macos_x64_clang.yml

@@ -30,7 +30,7 @@ jobs:
         shell: bash
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: "Updating git submodules"
         run: git submodule update --init --jobs 8 --depth 1
       # There may be multiple versions of Xcode and SDKs installed.
@@ -41,7 +41,7 @@ jobs:
           xcrun metal --version
           xcrun metallib --version
       - name: "Setting up Python"
-        uses: actions/[email protected]
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.1.0
         with:
           python-version: "3.10"
           cache: "pip"

.github/workflows/ci_windows_x64_msvc.yml

@@ -30,11 +30,11 @@ jobs:
       BUILD_DIR: build-windows
     steps:
       - name: "Checking out repository"
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: "Setting up Python"
-        uses: actions/[email protected]
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.1.0
         with:
           python-version: "3.10" # Needs pybind >= 2.10.1 for Python >= 3.11
       - name: "Installing Python packages"
@@ -45,7 +45,7 @@ jobs:
       - name: "Installing requirements"
         run: choco install ccache --yes
       - name: "Configuring MSVC"
-        uses: ilammy/[email protected]
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
       - name: "Building IREE"
         run: ./build_tools/cmake/build_all.sh "${BUILD_DIR}"
       - name: "Testing IREE"

.github/workflows/lint.yml

@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checking out repository
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Setting up python
-        uses: actions/[email protected]
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.1.0
       - name: Running pre-commit
-        uses: pre-commit/[email protected]
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/oneshot_candidate_release.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checking out repository
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           token: ${{ secrets.WRITE_ACCESS_TOKEN }}
 
@@ -26,7 +26,7 @@ jobs:
           git tag "${tag_name}"
 
       - name: Pushing changes
-        uses: ad-m/[email protected]
+        uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0
         with:
           github_token: ${{ secrets.WRITE_ACCESS_TOKEN }}
           branch: ${{ github.ref_name }}
@@ -46,7 +46,7 @@ jobs:
           prerelease: true
 
       - name: "Invoke workflow :: Build Release Packages"
-        uses: benc-uk/workflow-dispatch@798e70c97009500150087d30d9f11c5444830385 # v1.2.2
+        uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4
         with:
           workflow: Build Release Packages
           token: ${{ secrets.WRITE_ACCESS_TOKEN }}

.github/workflows/pkgci_build_packages.yml

@@ -32,7 +32,7 @@ jobs:
         run: |
           docker pull "$MANYLINUX_DOCKER_IMAGE" &
       - name: Checking out repository
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: true
       - name: Write version info
@@ -71,7 +71,7 @@ jobs:
           # permissions. Take them back.
           sudo chown -R "$(whoami)" "${cache_dir}"
       - name: Upload wheel artifacts
-        uses: actions/upload-artifact@v4.3.3
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: linux_x86_64_release_packages
           path: |
@@ -97,7 +97,7 @@ jobs:
 #       run: |
 #         docker pull "$MANYLINUX_DOCKER_IMAGE" &
 #     - name: "Checking out repository"
-#       uses: actions/[email protected]
+#       uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 #       with:
 #         submodules: true
 #     - name: Write version info
@@ -136,7 +136,7 @@ jobs:
 #         # permissions. Take them back.
 #         sudo chown -R "$(whoami)" "${cache_dir}"
 #     - name: Upload wheel artifacts
-#       uses: actions/upload-artifact@v4.3.3
+#       uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
 #       with:
 #         name: linux_x86_64_release_asserts_packages
 #         path: |

.github/workflows/pkgci_regression_test.yml

@@ -63,14 +63,14 @@ jobs:
       VENV_DIR: ${{ github.workspace }}/venv
     steps:
       - name: Checking out IREE repository
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: false
-      - uses: actions/[email protected]
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.1.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
           python-version: "3.11"
-      - uses: actions/[email protected].7
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}
@@ -82,7 +82,7 @@ jobs:
 
       # Out of tree tests
       - name: Check out external TestSuite repository
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           repository: nod-ai/SHARK-TestSuite
           ref: f5615ab29da491c0047146258dfa3a0c40c735e5
@@ -152,14 +152,14 @@ jobs:
       TEST_OUTPUT_ARTIFACTS: ${{ github.workspace }}/model_output_artifacts
     steps:
       - name: Checking out IREE repository
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: false
-      - uses: actions/[email protected]
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.1.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
           python-version: "3.11"
-      - uses: actions/[email protected].7
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}

.github/workflows/pkgci_test_amd_mi250.yml

@@ -33,16 +33,16 @@ jobs:
       IREE_HIP_TEST_TARGET_CHIP: "gfx90a"
     steps:
       - name: Check out repository
-        uses: actions/[email protected]
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: false
       - name: Check out runtime submodules
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
-      - uses: actions/[email protected]
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.1.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
           python-version: "3.11"
-      - uses: actions/[email protected].7
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}