Move paid CI runners and harden workflows

.github/actionlint.yaml

@@ -1,10 +1,10 @@
-# Depot and Jetson runners are organization-managed labels, not GitHub-hosted
+# Depot, ARC GPU and Jetson runners are organization-managed labels, not GitHub-hosted
 # runner labels. Allow them while retaining actionlint's runner validation for
 # every other label.
 self-hosted-runner:
   labels:
     - depot-ubuntu-*
-    - Roboflow-GPU-VM-Runner
+    - arc-gpu-runner-set
     - jetpack-*
     - jetson
 

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  # Keeps the SHA-pinned actions (and their version comments) current. One
+  # grouped PR per month limits CI runs spent on action bumps.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    # Skip releases younger than a week, so a compromised tag has time to be
+    # caught before it is pinned here.
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/build-osx-bundle.yml

@@ -12,6 +12,7 @@ on:
 jobs:
   build_osx:
     runs-on: macos-14
+    timeout-minutes: 120
     permissions:
       contents: write
     env:
@@ -20,11 +21,13 @@ jobs:
       NOTARY_PROFILE_NAME: "roboflow-notary"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
         # No 'path' means checkout to the root
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
 
@@ -189,15 +192,15 @@ jobs:
         run: python build.py
 
       - name: Upload macOS DMG Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: Roboflow-Inference-DMG-${{ steps.determine_version.outputs.BUILD_VERSION_ENV || 'dev' }} # Add version to artifact name
           path: app_bundles/osx/Roboflow-Inference-${{ steps.determine_version.outputs.BUILD_VERSION_ENV || 'unknown' }}.dmg
           if-no-files-found: error
 
       - name: Upload DMG to Release
         if: github.event_name == 'release' && steps.determine_version.outputs.BUILD_VERSION_ENV != '0.0.0-manual-dev' && steps.determine_version.outputs.BUILD_VERSION_ENV != ''
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/build-windows-installer-cpu.yml

@@ -20,11 +20,13 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
         # No 'path' means checkout to the root
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
 
@@ -79,7 +81,7 @@ jobs:
 
       - name: Install DigiCert Client tools
         id: install_digicert_tools # Renamed for clarity
-        uses: digicert/ssm-code-signing@v1.2.1
+        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
 
 
       - name: Set DigiCert certificate
@@ -331,7 +333,7 @@ jobs:
           echo "Installer signed successfully (based on smctl exit code and absence of 'FAILED' in CLI output). Review logs carefully."
 
       - name: Upload Windows Installer
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: Roboflow-Inference-Windows-Installer
           # The build.py script creates the installer in installer/inference-{version}-installer.exe
@@ -341,7 +343,7 @@ jobs:
 
       - name: Upload Installer to Release
         if: github.event_name == 'release'
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/build-windows-installer-gpu.yml

@@ -20,11 +20,13 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
         # No 'path' means checkout to the root
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
 
@@ -85,7 +87,7 @@ jobs:
 
       - name: Install DigiCert Client tools
         id: install_digicert_tools # Renamed for clarity
-        uses: digicert/ssm-code-signing@v1.2.1
+        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
 
 
       - name: Set DigiCert certificate
@@ -337,7 +339,7 @@ jobs:
           echo "Installer signed successfully (based on smctl exit code and absence of 'FAILED' in CLI output). Review logs carefully."
 
       - name: Upload Windows Installer
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: Roboflow-Inference-Windows-Installer
           # The build.py script creates the installer in installer/inference-{version}-installer.exe
@@ -347,7 +349,7 @@ jobs:
 
       - name: Upload Installer to Release
         if: github.event_name == 'release'
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/check_if_branch_is_mergeable.yml

@@ -12,6 +12,7 @@ jobs:
   check_if_branch_is_mergeable:
     name: Check if branch is mergeable
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       mergeable_state: ${{ steps.mergeable_check.outputs.mergeable_state }}
     steps:

.github/workflows/check_model_licenses.yml

@@ -19,9 +19,12 @@ concurrency:
 jobs:
   validate-models:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: "Validate model directories"
         run: |

.github/workflows/ci_image_build.yml

@@ -57,9 +57,9 @@ jobs:
           CI_DEPOT_ACTION: validate
         run: python3 .github/scripts/depot_ci_image.py
       - name: Set up Depot CLI
-        uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1
+        uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2
       - name: Set up Buildx for manifest inspection
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - name: Save image once and record platform digests
         id: build
         env:

.github/workflows/claude-pr-review.yml

@@ -52,6 +52,7 @@ jobs:
         )
       )
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       should_review: ${{ steps.gate.outputs.should_review }}
       number: ${{ steps.gate.outputs.number }}
@@ -153,7 +154,7 @@ jobs:
 
     steps:
       - name: Checkout trusted base branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ needs.gate.outputs.base_sha }}
           fetch-depth: 1
@@ -212,7 +213,7 @@ jobs:
       # Keep the agent's working directory and configuration on the trusted base.
       # PR source is data in a subdirectory, never a shell/action working directory.
       - name: Checkout PR source for static reading
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ needs.gate.outputs.head_sha }}
           path: review-source
@@ -284,13 +285,14 @@ jobs:
     needs: [gate, review]
     if: needs.gate.outputs.should_review == 'true' && fromJSON(needs.review.outputs.verdict || '{}').verdict == 'pass'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
       pull-requests: read
     steps:
       # A fresh runner, trusted base code, and NO Slack credentials. The agent's
       # workspace and processes cannot affect this collector.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ needs.gate.outputs.base_sha }}
           persist-credentials: false
@@ -314,7 +316,7 @@ jobs:
         run: '"$RUNNER_TEMP/maintainer-review/bin/python" .github/scripts/maintainer_review.py collect'
       - name: Publish handoff data
         if: steps.result.outputs.ready == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: maintainer-review-result-${{ github.run_attempt }}
           path: ${{ runner.temp }}/result.json

.github/workflows/docker.cpu.parallel.yml

@@ -37,21 +37,23 @@ jobs:
       PUBLISH: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true') }}
     steps:
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: 🛎️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
       - name: Read version from file
         run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV
       - name: Set up Depot CLI
-        uses: depot/setup-action@v1
+        uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2
       # Publishing runs push amd64 by digest, test that exact image, then reuse
       # the same digest in the multi-arch tags. Other runs only load and test.
       - name: Build and load CPU image (amd64)
         if: ${{ env.PUBLISH != 'true' }}
-        uses: depot/build-push-action@v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           push: false
           project: grl7ffzxd7
@@ -63,7 +65,7 @@ jobs:
       - name: Build and push CPU image by digest (amd64)
         id: amd64
         if: ${{ env.PUBLISH == 'true' }}
-        uses: depot/build-push-action@v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           project: grl7ffzxd7
           context: .
@@ -88,7 +90,7 @@ jobs:
       # arm64 is built but not runtime-tested.
       - name: Build CPU image and optionally push by digest (arm64)
         id: arm64
-        uses: depot/build-push-action@v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           project: grl7ffzxd7
           context: .

.github/workflows/docker.cpu.slim.yml

@@ -38,21 +38,23 @@ jobs:
       PUBLISH: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true') }}
     steps:
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: 🛎️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
       - name: Read version from file
         run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV
       - name: Set up Depot CLI
-        uses: depot/setup-action@v1
+        uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2
       # Publishing runs push amd64 by digest, test that exact image, then reuse
       # the same digest in the multi-arch tags. Other runs only load and test.
       - name: Build and load CPU image (amd64)
         if: ${{ env.PUBLISH != 'true' }}
-        uses: depot/build-push-action@v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           push: false
           project: grl7ffzxd7
@@ -64,7 +66,7 @@ jobs:
       - name: Build and push CPU image by digest (amd64)
         id: amd64
         if: ${{ env.PUBLISH == 'true' }}
-        uses: depot/build-push-action@v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           project: grl7ffzxd7
           context: .
@@ -89,7 +91,7 @@ jobs:
       # arm64 is built but not runtime-tested.
       - name: Build CPU image and optionally push by digest (arm64)
         id: arm64
-        uses: depot/build-push-action@v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           project: grl7ffzxd7
           context: .

.github/workflows/docker.cpu.yml

@@ -72,6 +72,8 @@ jobs:
           exit 1
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
       - name: Read version from file
         run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV
       - name: Determine Image Tags
@@ -92,22 +94,22 @@ jobs:
           first="${IMAGE_TAGS%%,*}"
           echo "image_tag=${first#"$BASE_IMAGE:"}" >> "$GITHUB_OUTPUT"
       - name: Set up Depot CLI
-        uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1
+        uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Authenticate gcloud
-        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         id: auth
         with:
           workload_identity_provider: "projects/878913763597/locations/global/workloadIdentityPools/github-actions/providers/github"
           service_account: "gha-inference@roboflow-staging.iam.gserviceaccount.com"
           token_format: access_token
           create_credentials_file: false
       - name: Login to Google Artifact Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: us-docker.pkg.dev
           username: oauth2accesstoken
@@ -134,7 +136,7 @@ jobs:
       # the same digest in the multi-arch tags. Other runs only load and test.
       - name: Build and load CPU image (amd64)
         if: ${{ env.PUBLISH != 'true' }}
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           push: false
           project: grl7ffzxd7
@@ -146,7 +148,7 @@ jobs:
       - name: Build and push CPU image by digest (amd64)
         id: amd64
         if: ${{ env.PUBLISH == 'true' }}
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           project: grl7ffzxd7
           context: .
@@ -171,7 +173,7 @@ jobs:
       # arm64 is built but not runtime-tested.
       - name: Build CPU image and optionally push by digest (arm64)
         id: arm64
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           project: grl7ffzxd7
           context: .