chore(ci): harden the workflows and check licences

.github/workflows/aas-oracle.yml

@@ -10,21 +10,27 @@ name: AAS loader oracle
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
-    branches: [main, develop]
+  workflow_dispatch:
 
 permissions:
   contents: read
 
+# See ci.yml for why `push` is main-only and `pull_request` carries no branch
+# filter (a filter excludes stacked PRs from CI entirely).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   load:
     name: Environments load in an AAS implementation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
 

.github/workflows/advisories.yml

@@ -0,0 +1,55 @@
+name: Advisories
+
+# 🚨 A new advisory against an unchanged lockfile reaches nobody.
+#
+# The `audit` job in ci.yml runs on pull requests and on pushes to `main`, which
+# means it answers "is this change safe" and nothing else. RUSTSEC advisories
+# are published against dependencies that are already in the tree — the tree
+# does not change, so no run is triggered, and the first anyone hears of it is
+# whenever somebody next happens to open a pull request. On a repo that can go a
+# week without one, that is the exposure window.
+#
+# This run exists to fail on a day when nothing was committed. It scans the
+# committed `Cargo.lock`, which is why that file is tracked: without it the
+# graph is re-resolved per run and a finding can appear or vanish between two
+# scans over an identical tree.
+
+on:
+  schedule:
+    # 06:00 UTC daily — early enough that a finding is waiting at the start of
+    # the day rather than after it.
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  advisories:
+    name: RUSTSEC advisories against the committed lockfile
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@3d23c1bbdafe696dfccad2664945a04f47d03dc3 # cargo-deny
+        with:
+          tool: cargo-deny
+      # Advisories only. Licences, bans and sources are a property of the tree
+      # and cannot change without a commit, so they belong on the pull-request
+      # run rather than here — a nightly failure should mean something new is
+      # known about the world, not that yesterday's policy still holds.
+      - name: cargo deny check advisories
+        run: cargo deny check advisories
+
+      # The same scan the pull-request path runs, against the same lockfile, so
+      # a disagreement between the two tools is visible rather than averaged
+      # away. `--deny yanked` catches the other thing that changes without a
+      # commit: a crate withdrawn from the registry after we pinned it.
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: cargo audit
+        run: cargo audit --deny yanked

.github/workflows/bench.yml

@@ -5,6 +5,10 @@ on:
     - cron: "0 3 * * 1"  # Monday 03:00 UTC
   workflow_dispatch:
 
+# Least privilege by default; see ci.yml.
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -13,14 +17,14 @@ jobs:
     name: Criterion benchmarks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - name: Run benchmarks
         run: cargo bench --package dpp-benches
       - name: Upload Criterion reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: criterion-reports
           path: target/criterion/

.github/workflows/ci.yml

@@ -1,10 +1,46 @@
 name: CI
 
+# One run per change, and a button for everything else.
+#
+# 🚨 `push: ["**"]` alongside `pull_request` ran the whole suite **twice** for
+# every push to a branch with an open PR — two runners, same commit, at the same
+# time. Beyond the double spend, it took two independent samples of every
+# timing-sensitive gate, so a flaky-by-timing job had two chances to trip per
+# push and could put a red X on a PR whose sibling run was green.
+#
+# `push` is now `main` only (the post-merge run) and `pull_request` is the
+# pre-merge one. Exactly one fires for any given change.
+#
+# 🚨 `pull_request` deliberately carries **no branch filter**. The filter names
+# the branch a PR is *merging into*, so `branches: [main]` silently excludes
+# every **stacked** PR — one opened against another feature branch matches
+# nothing. Today that is masked by `push: ["**"]` running on all branches; drop
+# that trigger without also dropping the filter and stacked PRs get no CI at
+# all, which is worse than the double run being fixed here.
+#
+# `develop` is gone: no such branch exists on this remote. It was dead config
+# that read as though a second integration branch were gated.
+#
+# `workflow_dispatch` covers what `push: ["**"]` was really serving — running
+# the full suite on a branch before opening a PR.
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
-    branches: [main, develop]
+  workflow_dispatch:
+
+# Least privilege by default. Any job needing more asks for it locally rather
+# than every job inheriting a token that can write.
+permissions:
+  contents: read
+
+# Cancel a superseded run rather than paying for it. A rebase or a follow-up
+# push makes the in-flight run answer a question nobody is asking any more.
+# `main` is excluded from cancellation: the post-merge run is the record for
+# that commit, and cancelling it would leave a merged commit never fully built.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 env:
   CARGO_TERM_COLOR: always
@@ -15,7 +51,7 @@ jobs:
     name: Format check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           components: rustfmt
@@ -26,7 +62,7 @@ jobs:
     name: Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           components: clippy
@@ -38,7 +74,7 @@ jobs:
     name: Tests (unit + integration)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - name: Install cargo-nextest
@@ -60,7 +96,7 @@ jobs:
     name: Docs (rustdoc + doctests)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       # `just check` has always run both of these and CI never did, which left a
@@ -87,19 +123,41 @@ jobs:
     name: Security audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      # 🚨 Runs before the scanners, because a lockfile they trust is only worth
+      # tracking if something proves it still describes the manifests. Bump a
+      # version in a `Cargo.toml` without regenerating and the scans below — and
+      # the daily advisory run — keep reading the old graph, green and wrong.
+      # `fuzz/Cargo.lock` was already in that state when this check was added:
+      # it still pinned the workspace crates at 0.10.0.
+      - name: Lockfiles match their manifests
+        run: |
+          for ws in . plugins fuzz; do
+            (cd "$ws" && cargo metadata --locked --format-version 1 > /dev/null)
+          done
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
       - name: cargo audit
-        run: cargo audit
+        run: cargo audit --deny yanked
+      # The three questions `cargo audit` cannot answer — licences, duplicate or
+      # banned crates, and dependency provenance. Licences went unchecked here
+      # until this job existed, which for a published Apache-2.0 library is the
+      # gap that mattered: a consumer vendoring this crate inherits its graph's
+      # obligations.
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@3d23c1bbdafe696dfccad2664945a04f47d03dc3 # cargo-deny
+        with:
+          tool: cargo-deny
+      - name: cargo deny
+        run: cargo deny check bans licenses sources
 
   plugins:
     name: Sector plugin tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - uses: taiki-e/install-action@3d23c1bbdafe696dfccad2664945a04f47d03dc3 # just

.github/workflows/fuzz.yml

@@ -7,6 +7,10 @@ on:
     - cron: "0 3 * * *" # nightly 03:00 UTC
   workflow_dispatch:
 
+# Least privilege by default; see ci.yml.
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
@@ -20,7 +24,7 @@ jobs:
       matrix:
         target: [digital_link_parse]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       # The trailing comment is load-bearing, not decoration. `rust-toolchain`
       # keeps one branch per channel and bakes that channel into the `toolchain`
       # input's *default* on each branch — this SHA defaults to `nightly`, the
@@ -37,7 +41,7 @@ jobs:
         run: cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=60 -max_len=4096
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: fuzz-artifacts-${{ matrix.target }}
           path: fuzz/artifacts/

.github/workflows/gs1-oracle.yml

@@ -14,26 +14,32 @@ name: GS1 syntax oracle
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
-    branches: [main, develop]
+  workflow_dispatch:
 
 permissions:
   contents: read
 
+# See ci.yml for why `push` is main-only and `pull_request` carries no branch
+# filter (a filter excludes stacked PRs from CI entirely).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   syntax:
     name: Digital Links are well-formed GS1
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # No Rust toolchain action. `rust-toolchain.toml` pins the channel, and
       # rustup is already on the runner, so invoking cargo selects the pinned
       # toolchain by itself — an action here would add a third-party dependency
       # to a job whose entire purpose is running somebody else's tool, and
       # `@stable` would name a channel this repo does not build against.
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: "22"
 

.github/workflows/jades-oracle.yml

@@ -22,16 +22,17 @@
 # device and a QTSP together. None is a property of the bytes.
 name: JAdES conformance oracle
 
+# See ci.yml for why `push` is main-only and `pull_request` carries no branch
+# filter (a filter excludes stacked PRs from CI entirely).
 on:
   push:
-    branches: ["**"]
+    branches: [main]
     paths:
       - "crates/dpp-crypto/src/jades/**"
       - "crates/dpp-crypto/tests/jades_oracle_artifact.rs"
       - ".github/oracle/jades/**"
       - ".github/workflows/jades-oracle.yml"
   pull_request:
-    branches: [main, develop]
     paths:
       - "crates/dpp-crypto/src/jades/**"
       - "crates/dpp-crypto/tests/jades_oracle_artifact.rs"
@@ -42,17 +43,21 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   validate:
     name: DSS recognises the signature as JAdES-BASELINE-B
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
         with:
           distribution: temurin
           java-version: "17"
@@ -81,7 +86,7 @@ jobs:
       # exact bytes DSS judged are recoverable.
       - name: Upload the artefact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: jades-artefact
           path: target/jades-oracle/

.github/workflows/pr-title.yml

@@ -18,6 +18,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   conventional-commit:
     name: PR title is a conventional commit