ci: add actionlint and action version check

Author: aquint-zama

.github/actionlint.yaml

@@ -0,0 +1,16 @@
+# Configuration related to self-hosted runner.
+self-hosted-runner:
+  # Labels of self-hosted runner in array of strings.
+  labels:
+    - large_ubuntu_16
+    - large_ubuntu_32
+    - large_windows_16_latest
+    - large_ubuntu_16_arm
+    - large_ubuntu_16-22.04
+    - large_ubuntu_64-22.04
+    - gpu_ubuntu-22.04
+    - aws-mac2-metal
+    - office-m1-mac-mini
+    - m1mac
+    - 4090-desktop
+    - aws-mac1-metal

.github/workflows/linkchecker.yml

@@ -13,7 +13,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
       - uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # v1.0.15
         with:
           use-quiet-mode: "yes"

.github/workflows/commitlint.yml renamed to .github/workflows/lint.yml

@@ -1,15 +1,21 @@
-name: Run commitlint on PR
+name: Run lint on PR
 
 on:
   pull_request:
 
 jobs:
-  commitlint:
+  lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           fetch-depth: 0
+      - name: actionlint
+        uses: raven-actions/actionlint@01fce4f43a270a612932cb1c64d40505a029f821 # v2.0.0
+
+      - name: Ensure SHA pinned actions
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@64418826697dcd77c93a8e4a1f7601a1942e57b5 # v3.0.18
+
       - name: Setup Node
         uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
@@ -20,3 +26,5 @@ jobs:
           npm install -g @commitlint/cli@^18
       - name: Validate all commits from PR
         run: npx commitlint --config .github/config/commitlint.config.ts --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
+
+

.github/workflows/publish.yml

@@ -17,12 +17,12 @@ jobs:
       - run: cp .env.example .env
       - run: npm ci --include=optional
       - run: mkdir node_modules/fhevm-core-contracts/addresses
-      - run: source .env && npx hardhat task:computeGatewayAddress --private-key $PRIVATE_KEY_GATEWAY_DEPLOYER
-      - run: source .env && npx hardhat task:computeACLAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER
-      - run: source .env && npx hardhat task:computeTFHEExecutorAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER
-      - run: source .env && npx hardhat task:computeKMSVerifierAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER
-      - run: source .env && npx hardhat task:computeInputVerifierAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER --use-address false
-      - run: source .env && npx hardhat task:computeFHEGasLimitAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER
+      - run: source .env && npx hardhat task:computeGatewayAddress --private-key "$PRIVATE_KEY_GATEWAY_DEPLOYER"
+      - run: source .env && npx hardhat task:computeACLAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER"
+      - run: source .env && npx hardhat task:computeTFHEExecutorAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER"
+      - run: source .env && npx hardhat task:computeKMSVerifierAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER"
+      - run: source .env && npx hardhat task:computeInputVerifierAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER" --use-address false
+      - run: source .env && npx hardhat task:computeFHEGasLimitAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER"
       - run: npm run compile
       - uses: JS-DevTools/npm-publish@19c28f1ef146469e409470805ea4279d47c3d35c # v3.1.1
         with:

.github/workflows/publishprerelease.yml

@@ -17,12 +17,12 @@ jobs:
       - run: cp .env.example .env
       - run: npm ci --include=optional
       - run: mkdir node_modules/fhevm-core-contracts/addresses
-      - run: source .env && npx hardhat task:computeGatewayAddress --private-key $PRIVATE_KEY_GATEWAY_DEPLOYER
-      - run: source .env && npx hardhat task:computeACLAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER
-      - run: source .env && npx hardhat task:computeTFHEExecutorAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER
-      - run: source .env && npx hardhat task:computeKMSVerifierAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER
-      - run: source .env && npx hardhat task:computeInputVerifierAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER --use-address false
-      - run: source .env && npx hardhat task:computeFHEGasLimitAddress --private-key $PRIVATE_KEY_FHEVM_DEPLOYER
+      - run: source .env && npx hardhat task:computeGatewayAddress --private-key "$PRIVATE_KEY_GATEWAY_DEPLOYER"
+      - run: source .env && npx hardhat task:computeACLAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER"
+      - run: source .env && npx hardhat task:computeTFHEExecutorAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER"
+      - run: source .env && npx hardhat task:computeKMSVerifierAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER"
+      - run: source .env && npx hardhat task:computeInputVerifierAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER" --use-address false
+      - run: source .env && npx hardhat task:computeFHEGasLimitAddress --private-key "$PRIVATE_KEY_FHEVM_DEPLOYER"
       - run: npm run compile
       - uses: JS-DevTools/npm-publish@19c28f1ef146469e409470805ea4279d47c3d35c # v3.1.1
         with: