Merge branch 'main' of https://github.com/mozilla/neqo into watermark

.github/actions/nss/action.yml

@@ -49,14 +49,14 @@ runs:
     #
     # - name: Checkout NSPR
     #   if: env.BUILD_NSS == '1'
-    #   uses: actions/checkout@v4
+    #   uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
     #   with:
     #     repository: "nss-dev/nspr"
     #     path: ${{ github.workspace }}/nspr
 
     # - name: Checkout NSS
     #   if: env.BUILD_NSS == '1'
-    #   uses: actions/checkout@v4
+    #   uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
     #   with:
     #     repository: "nss-dev/nss"
     #     path: ${{ github.workspace }}/nss

.github/actions/pr-comment-data-export/action.yml

@@ -31,7 +31,7 @@ runs:
           echo "${{ inputs.log-url }}" > comment-data/log-url
         fi
     - if: github.event_name == 'pull_request'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
       with:
         name: ${{ inputs.name }}
         path: comment-data

.github/actions/pr-comment/action.yml

@@ -15,7 +15,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
       with:
         run-id: ${{ github.event.workflow_run.id }}
         name: ${{ inputs.name }}
@@ -32,7 +32,7 @@ runs:
           echo "[:arrow_down: Download logs]($(cat log-url))" >> contents
         fi
 
-    - uses: thollander/actions-comment-pull-request@v2
+    - uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # v2.5.0
       with:
         filePath: contents
         mode: ${{ inputs.mode }}

.github/actions/quic-interop-runner/action.yml

@@ -24,7 +24,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout quic-interop/quic-interop-runner repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
       with:
         repository: 'quic-interop/quic-interop-runner'
         path: 'quic-interop-runner'
@@ -40,7 +40,7 @@ runs:
         sudo apt-get install -y --no-install-recommends tshark
       shell: bash
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
       with:
         python-version: 3.8
         cache: 'pip'
@@ -74,7 +74,7 @@ runs:
         python run.py $ARGS 2>&1 | tee ../summary.txt || true
       shell: bash
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
       id: upload-logs
       with:
         name: '${{ inputs.client }} vs. ${{ inputs.server }} logs'
@@ -88,7 +88,7 @@ runs:
           mv result.json.tmp result.json
       shell: bash
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
       with:
         name: '${{ inputs.client }} vs. ${{ inputs.server }} results'
         path: |

.github/actions/rust/action.yml

@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@master
+      uses: dtolnay/rust-toolchain@bb45937a053e097f8591208d8e74c90db1873d07 # master
       with:
         toolchain: ${{ inputs.version }}
         components: ${{ inputs.components }}
@@ -35,7 +35,7 @@ runs:
     # sccache slows CI down, so we leave it disabled.
     # Leaving the steps below commented out, so we can re-evaluate enabling it later.
     # - name: Use sccache
-    #   uses: mozilla-actions/[email protected]
+    #   uses: mozilla-actions/sccache-action@2e7f9ec7921547d4b46598398ca573513895d0bd # v0.0.4
 
     # - name: Enable sscache
     #   shell: bash
@@ -53,6 +53,6 @@ runs:
 
     # Ditto for rust-cache.
     # - name: Use Rust cache
-    #   uses: Swatinem/rust-cache@v2
+    #   uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
     #   with:
     #     cache-all-crates: "true"

.github/workflows/actionlint.yml

@@ -12,14 +12,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions: read-all
+
 jobs:
   actionlint:
     runs-on: ubuntu-latest
     defaults:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
       - name: Download actionlint
         id: get_actionlint
         run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)

.github/workflows/bench-comment.yml

@@ -12,6 +12,8 @@ on:
     types:
       - completed
 
+permissions: read-all
+
 jobs:
   comment:
     permissions:
@@ -21,7 +23,7 @@ jobs:
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
       - uses: ./.github/actions/pr-comment
         with:
           name: bench

.github/workflows/bench.yml

@@ -14,6 +14,8 @@ env:
   RUSTFLAGS: -C link-arg=-fuse-ld=lld -C link-arg=-Wl,--no-rosegment, -C force-frame-pointers=yes
   PERF_OPT: record -F997 --call-graph fp -g
 
+permissions: read-all
+
 jobs:
   bench:
     name: Benchmark
@@ -24,10 +26,10 @@ jobs:
 
     steps:
       - name: Checkout neqo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
 
       - name: Checkout msquic
-        uses: actions/checkout@v4
+        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           repository: microsoft/msquic
           ref: main
@@ -60,7 +62,7 @@ jobs:
 
       - name: Download cached main-branch results
         id: criterion-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: ./target/criterion
           key: criterion-${{ runner.name }}-${{ github.sha }}
@@ -220,14 +222,14 @@ jobs:
 
       - name: Cache main-branch results
         if: github.ref == 'refs/heads/main'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: ./target/criterion
           key: criterion-${{ runner.name }}-${{ github.sha }}
 
       - name: Export perf data
         id: export
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: ${{ github.event.repository.name }}-${{ github.sha }}
           path: |

.github/workflows/check.yml

@@ -15,6 +15,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions: read-all
+
 jobs:
   check:
     name: Build & test
@@ -23,8 +25,9 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-14, windows-latest]
         # Don't increase beyond what Firefox is currently using:
-        # https://firefox-source-docs.mozilla.org/writing-rust-code/update-policy.html#schedule
-        rust-toolchain: [1.74.0, stable, nightly]
+        # https://searchfox.org/mozilla-central/search?q=MINIMUM_RUST_VERSION&path=python/mozboot/mozboot/util.py
+        # Keep in sync with Cargo.toml
+        rust-toolchain: [1.76.0, stable, nightly]
         type: [debug]
         include:
           - os: ubuntu-latest
@@ -39,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
 
       - name: Install dependencies (Linux)
         if: runner.os == 'Linux'
@@ -73,6 +76,8 @@ jobs:
       - name: Set up MSVC build environment (Windows)
         if: runner.os == 'Windows'
         uses: ilammy/msvc-dev-cmd@v1
+        # TODO: Would like to pin this, but the Mozilla org allowlist requires "ilammy/msvc-dev-cmd@v1*"
+        # uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
 
       - name: Set up NSS/NSPR build environment (Windows)
         if: runner.os == 'Windows'
@@ -147,7 +152,7 @@ jobs:
         if: success() || failure()
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@84508663e988701840491b86de86b666e8a86bed # v4.3.0
         with:
           file: lcov.info
           fail_ci_if_error: false

.github/workflows/mutants.yml

@@ -11,11 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions: read-all
+
 jobs:
   mutants:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           fetch-depth: 0
 
@@ -61,7 +63,7 @@ jobs:
           } > "$GITHUB_STEP_SUMMARY"
 
       - name: Archive mutants.out
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         if: always()
         with:
           name: mutants.out

.github/workflows/qns-comment.yml

@@ -12,6 +12,8 @@ on:
     types:
       - completed
 
+permissions: read-all
+
 jobs:
   comment:
     permissions:
@@ -20,7 +22,7 @@ jobs:
     if: |
       github.event.workflow_run.event == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
       - uses: ./.github/actions/pr-comment
         with:
           name: qns