Each third-party action that StepSecurity publishes a secure drop-in
replacement for now uses that replacement, pinned to a commit with its
version as a comment. Versions follow what we used: the newest
StepSecurity release in the same major, or the closest major they
publish. dtolnay/rust-toolchain refs that named a toolchain (stable,
nightly, 1.76) become the replacement's `toolchain` input.
Adds step-security/harden-runner (audit, pinned to v2.22.4 like
craft-common-actions) as the first step of each job that did not have it,
so every workflow in the org's public repos reports its egress to
StepSecurity. Audit, not block: block-mode allow lists come from each
job's observed traffic.
* ci: save the dependency cache from main only, and cancel superseded PR runs
* ci: give runs outside pull requests their own concurrency group
---------
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
* ci: window and ui run macOS only when started by hand
macOS runners are kept for releases. Pushes and pull requests run Linux and Windows; workflow_dispatch runs all three.
* ci: the other workflows run macOS only when started by hand
atomic, docpath, ai-core, i18n, print, pdf, update and keymap follow window and ui: Linux and Windows on pushes and pull requests (keymap: Windows), all their platforms on workflow_dispatch.
Pin third-party actions to full-length commit SHAs (with version comments)
instead of mutable tags/branches to prevent supply-chain tampering via
retagged releases. Resolves SonarCloud rule githubactions:S7637.
Dylan M. Taylor