[5.4-tsan] Sync 5.4.0-semgrep-tsan with 5.4.0-semgrep

.github/workflows/build-cross.yml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout OCaml
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
       - name: Configure, build and install OCaml
@@ -57,7 +57,7 @@ jobs:
           cd "$HOME"
           tar caf /tmp/ocaml.tar.zst .local
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: non-cross-ocaml
           path: /tmp/ocaml.tar.zst
@@ -68,7 +68,7 @@ jobs:
     needs: non-cross
     steps:
       - name: Download Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: non-cross-ocaml
       - name: Install non-cross OCaml and set up environment
@@ -80,7 +80,7 @@ jobs:
           sudo apt-get update -y
           sudo apt-get install -y gcc-mingw-w64-x86-64
       - name: Checkout OCaml
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           submodules: true
           persist-credentials: false
@@ -107,7 +107,7 @@ jobs:
           cat example.ml
           $HOME/cross/bin/ocamlopt.opt.exe -I $HOME/cross/lib/ocaml/compiler-libs/ ocamlcommon.cmxa ocamloptcomp.cmxa example.ml -o example.exe -verbose
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: windows-executable
           path: example.exe
@@ -127,7 +127,7 @@ jobs:
     needs: cross-windows
     steps:
       - name: Download Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: windows-executable
       - name: Run example program
@@ -139,7 +139,7 @@ jobs:
     needs: non-cross
     steps:
       - name: Download Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: non-cross-ocaml
       - name: Install non-cross OCaml and set up environment
@@ -151,7 +151,7 @@ jobs:
           sudo apt-get update -y
           sudo apt-get install -y gcc-aarch64-linux-gnu qemu-user
       - name: Checkout OCaml
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           submodules: true
           persist-credentials: false
@@ -193,7 +193,7 @@ jobs:
     needs: non-cross
     steps:
       - name: Download Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: non-cross-ocaml
       - name: Install non-cross OCaml
@@ -203,7 +203,7 @@ jobs:
           rm -f ocaml.tar.zst
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Restore the Android NDK from cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         id: cache
         with:
           path: |
@@ -219,14 +219,14 @@ jobs:
           rm android-ndk-r27b-linux.zip
         if: steps.cache.outputs.cache-hit != 'true'
       - name: Save the Android NDK to cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             /home/runner/android
           key: android-ndk
         if: steps.cache.outputs.cache-hit != 'true'
       - name: Checkout OCaml
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
       - name: Configure, build and install Linux-to-Android OCaml
@@ -263,7 +263,7 @@ jobs:
           $HOME/cross/bin/ocamlopt.opt example.ml -o example -verbose
           file example
       - name: Run example
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
         with:
           api-level: 21
           arch: x86_64

.github/workflows/build-msvc.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       - name: Compute matrix for the "build" job
         id: matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             // # Always test cl and clang-cl
@@ -58,7 +58,7 @@ jobs:
             return {config_arg: [''], arch: ['x86_64'], cc: compilers, include: include};
       - name: Determine if the testsuite should be skipped
         id: skip
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             let skip_testsuite = false;
@@ -88,32 +88,32 @@ jobs:
     steps:
 
       - name: Fetch OCaml
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           submodules: true
 
       - name: Restore Cygwin cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             C:\cygwin-packages
           key: cygwin-packages
 
       - name: Install Cygwin
-        uses: cygwin/cygwin-install-action@v3
+        uses: cygwin/cygwin-install-action@f5e0f048310c425e84bc789f493a828c6dc80a25 # v3
         with:
           packages: make,${{ matrix.cc != 'gcc' && 'mingw64-x86_64-' || 'gcc-fortran,' }}gcc-core
           install-dir: 'D:\cygwin'
 
       - name: Save Cygwin cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             C:\cygwin-packages
           key: cygwin-packages
 
       - name: Set up MSVC
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
         with:
           arch: ${{ matrix.arch == 'x86_64' && 'x64' || 'x86' }}
         if: matrix.cc != 'gcc'
@@ -126,7 +126,7 @@ jobs:
           echo "key=${{ env.HOST }}-${{ matrix.cc }}-${{ hashFiles('configure') }}" >> $GITHUB_OUTPUT
 
       - name: Restore Autoconf cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             config.cache
@@ -156,7 +156,7 @@ jobs:
           fi
 
       - name: Save Autoconf cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             config.cache

.github/workflows/build.yml

@@ -39,7 +39,7 @@ jobs:
       manual_changed: ${{ steps.manual.outputs.manual_changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
       - name: Check for manual changes
@@ -66,7 +66,7 @@ jobs:
       - name: Prepare Artifact
         run: tar --zstd -cf /tmp/sources.tar.zstd .
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: compiler
           path: /tmp/sources.tar.zstd
@@ -95,7 +95,7 @@ jobs:
       fail-fast: true
     steps:
       - name: Download Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: compiler
       - name: Unpack Artifact
@@ -153,7 +153,7 @@ jobs:
     steps:
       - name: Compute matrix for the "others" job
         id: jobs
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             // # Default jobs: Linux -O0, Linux arm64 & macOS
@@ -186,7 +186,7 @@ jobs:
             return jobs;
       - name: Determine if the testsuite should be skipped
         id: skip
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             let skip_testsuite = false;
@@ -208,7 +208,7 @@ jobs:
       fail-fast: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
       - name: macOS Dependencies
@@ -257,7 +257,7 @@ jobs:
           adduser --disabled-password --gecos '' ocaml
       - name: Checkout
         # See https://github.com/actions/checkout/issues/334
-        uses: actions/checkout@v1
+        uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       - name: configure tree
         run: |
           chown -R ocaml:ocaml .

.github/workflows/hygiene.yml

@@ -28,7 +28,7 @@ jobs:
         # context variable.
         if: failure()
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 50
           persist-credentials: false

.github/workflows/multicoretests.yml

@@ -25,29 +25,29 @@ jobs:
             ocamlrunparam: b,s=4096
     steps:
       - name: Checkout OCaml
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           path: ocaml
           persist-credentials: false
       - name: Configure, build and install OCaml
         run: |
           bash -xe ocaml/tools/ci/actions/multicoretests.sh ocaml
       - name: Checkout multicoretests
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: ocaml-multicore/multicoretests
           ref: 0.8
           path: multicoretests
           persist-credentials: false
       - name: Checkout QCheck
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: c-cube/qcheck
           ref: v0.25
           path: multicoretests/qcheck
           persist-credentials: false
       - name: Checkout dune
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: ocaml/dune
           ref: 3.18.0

.github/workflows/parsetree-change.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify ppxlib maintainers
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             github.rest.issues.createComment({
@@ -28,7 +28,7 @@ jobs:
               body: 'CC @ocaml/ppxlib-dev'
             })
       - name: Label PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             github.rest.issues.addLabels({

.github/workflows/tsan.yml

@@ -29,7 +29,7 @@ jobs:
       manual_changed: ${{ steps.manual.outputs.manual_changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
       - name: Install libunwind
@@ -51,7 +51,7 @@ jobs:
       - name: Prepare Artifact
         run: tar --zstd -cf /tmp/sources.tar.zstd .
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: compiler
           path: /tmp/sources.tar.zstd
@@ -77,7 +77,7 @@ jobs:
             dependencies: libunwind-dev
     steps:
       - name: Download Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: compiler
       - name: Unpack Artifact