From 4aa0319989407c12feb468887618d77fa297e4f0 Mon Sep 17 00:00:00 2001
From: Lars Eggert <lars@eggert.org>
Date: Fri, 13 Sep 2024 05:21:53 -0700
Subject: [PATCH] ci: Pin NSS to prevent build hang on Windows (#2106)

* ci: Try and fix NSS build on Windows

* Again

* Older NSS

* Path

* Next rev

* Pin
---
 .github/actions/nss/action.yml | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/.github/actions/nss/action.yml b/.github/actions/nss/action.yml
index d851902eb3..94361f4a89 100644
--- a/.github/actions/nss/action.yml
+++ b/.github/actions/nss/action.yml
@@ -59,35 +59,33 @@ runs:
         echo "System NSS is suitable: $NSS_VERSION"
         echo "BUILD_NSS=0" >> "$GITHUB_ENV"
 
-    # Ideally, we'd use actions/checkout. But things are sufficiently flaky that we're better off
-    # trying both hg and git.
-
     - name: Checkout NSS
-      shell: bash
       if: env.BUILD_NSS == '1'
-      run: |
-        git clone --depth=1 https://github.com/nss-dev/nss "${{ github.workspace }}/nss" || \
-          hg clone https://hg.mozilla.org/projects/nss "${{ github.workspace }}/nss"
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      with:
+        repository: nss-dev/nss
+        ref: c631e9cb5ed1806038f7b85fbbc825f856c9d133 # later revisions hang when building on Windows
+        path: nss
 
     - name: Checkout NSPR
-      shell: bash
       if: env.BUILD_NSS == '1'
-      run: |
-        git clone --depth=1 https://github.com/nss-dev/nspr "${{ github.workspace }}/nspr" || \
-          hg clone https://hg.mozilla.org/projects/nspr "${{ github.workspace }}/nspr"
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      with:
+        repository: nss-dev/nspr
+        path: nspr
 
     - name: Install build dependencies (Linux)
       shell: bash
       if: runner.os == 'Linux' && env.BUILD_NSS == '1' && runner.environment == 'github-hosted'
       env:
         DEBIAN_FRONTEND: noninteractive
-      run: sudo apt-get install -y --no-install-recommends git mercurial gyp ninja-build
+      run: sudo apt-get install -y --no-install-recommends gyp ninja-build
 
     - name: Install build dependencies (MacOS)
       shell: bash
       if: runner.os == 'MacOS' && env.BUILD_NSS == '1'
       run: |
-        brew install mercurial ninja
+        brew install ninja
         echo "gyp-next>=0.18.1" > req.txt
         python3 -m pip install --user --break-system-packages -r req.txt
         echo "$(python3 -m site --user-base)/bin" >> "$GITHUB_PATH"
@@ -101,7 +99,7 @@ runs:
           echo C:/msys64/usr/bin
           echo C:/msys64/mingw64/bin
         } >> "$GITHUB_PATH"
-        /c/msys64/usr/bin/pacman -S --noconfirm python3-pip mercurial nsinstall
+        /c/msys64/usr/bin/pacman -S --noconfirm python3-pip nsinstall
         echo "gyp-next>=0.18.1" > req.txt
         python3 -m pip install -r req.txt