ci: update and pin github actions

[joshuasing]

Update GitHub Actions to latest versions, and pin all used actions (except oss-fuzz) to full-length commit hashes to make them immutable. This prevents unexpected changes, and malicious updates or compromise of used actions.

https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

Action	Update	Change
actions/checkout	major	v4 -> v6.0.1 (8e8c483)
actions/upload-artifact	major	v4 -> v6.0.0 (b7c566a)
msys2/setup-msys2	pin	v2 -> v2.30.0 (4f806de)
mymindstorm/setup-emsdk	pin	v14 -> v14 (6ab9eb1)
softprops/action-gh-release	pin	v2 -> v2.5.0 (a06a81a)
vmactions/freebsd-vm	pin	v1 -> v1.3.0 (670398e)
vmactions/solaris-vm	pin	v1 -> v1.1.8 (47bea10)

[botovq]

This looks good - I double checked the hashes.

• I guess once this is merged, we should also tighten the settings in our repo settings?
• How do we know the jobs that aren't run as part of PR CI actually work: upload-artifact, gh-release, freebsd/solaris?

[joshuasing]

This looks good - I double checked the hashes.

Great, thanks!

* I guess once this is merged, we should also tighten the settings in our repo settings?

Yes, GitHub now has policy settings to require actions to be pinned to full-length commit hashes, as well as restrict used third-party actions to only those allowed through GitHub settings. I think it would be a good idea to enable both of these, especially given the recent supply-chain attacks targetting GitHub workflows.

There's also "Immutable Releases" now, which would make all assets on releases for this repository immutable - which I think would also be good to enable. I need to check that the current release CI will work with it first, however.

* How do we know the jobs that aren't run as part of PR CI actually work: upload-artifact, gh-release, freebsd/solaris?

For gh-release and freebsd/solaris, the version shouldn't have changed compared to what would be used currently otherwise (non-pinned, since it would choose the latest release matching the tag).

For upload-artifact, it looks like most of the changes between v4 and v6 were non-functional changes (e.g. node version updates), but I also tested the new version in a repo to make sure it is still working.

[botovq]

I think it would be a good idea to enable both of these, especially given the recent supply-chain attacks targetting GitHub workflows.

Agreed. May I leave that to you (I'll try to merge in an hour or so).

Re "immutable Releases" that sounds like what we want indeed.

Your tests seems good enough then. Thanks!

[joshuasing]

I think it would be a good idea to enable both of these, especially given the recent supply-chain attacks targetting GitHub workflows.

Agreed. May I leave that to you (I'll try to merge in an hour or so).

Re "immutable Releases" that sounds like what we want indeed.

Yep! I'll look into getting these setup this week/weekend.

Your tests seems good enough then. Thanks!

No worries! :D