ci: pin nightly and actions, allow rebuilding a tag

Author: QaidVoid

.github/workflows/release-plz.yml

@@ -5,6 +5,11 @@ on:
     branches:
       - main
 
+env:
+  # Kept in step with the release workflow so a release builds and publishes
+  # on one toolchain. See .github/workflows/release.yml for why it is pinned.
+  RUST_NIGHTLY: nightly-2026-09-09
+
 jobs:
   release-plz-release:
     name: Release-plz release
@@ -13,13 +18,15 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: ${{ env.RUST_NIGHTLY }}
       - name: Run release-plz
-        uses: release-plz/action@v0.5
+        uses: release-plz/action@a80d79efe0a195618acb02a4089d55fe74d2505f # v0.5.136
         with:
           command: release
         env:
@@ -37,14 +44,16 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PLZ_TOKEN }}
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: ${{ env.RUST_NIGHTLY }}
       - name: Run release-plz
-        uses: release-plz/action@v0.5
+        uses: release-plz/action@a80d79efe0a195618acb02a4089d55fe74d2505f # v0.5.136
         with:
           command: release-pr
         env:

.github/workflows/release.yml

@@ -4,6 +4,10 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to rebuild assets for
+        required: true
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -15,6 +19,10 @@ permissions:
   id-token: write
 
 env:
+  # Pinned because nightly-2026-09-12 started passing -Wl,--no-rosegment when
+  # linking loongarch64, which zig cc rejects as an unsupported linker arg.
+  # Lift once zig accepts it or rustc stops emitting it for that target.
+  RUST_NIGHTLY: nightly-2026-09-09
   ZIG_VERSION: 0.16.0
   ZIG_SHA256: 70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00
 
@@ -62,11 +70,9 @@ jobs:
             }
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set the release version
-        shell: bash
-        run: echo "RELEASE_VERSION=${GITHUB_REF:11}" >> $GITHUB_ENV
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Install dependencies
         shell: bash
@@ -75,8 +81,9 @@ jobs:
           sudo apt-get install -y --no-install-recommends musl-tools b3sum
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
+          toolchain: ${{ env.RUST_NIGHTLY }}
           targets: ${{ matrix.build.TARGET }}
           components: rust-src
 
@@ -138,16 +145,16 @@ jobs:
           b3sum appimageupdate-${{ matrix.build.NAME }}.tar.xz > appimageupdate-${{ matrix.build.NAME }}.tar.xz.b3sum
 
       - name: Upload to release
-        uses: svenstaro/upload-release-action@v2
+        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: appimageupdate-${{ matrix.build.NAME }}*
           file_glob: true
           overwrite: true
-          tag: ${{ github.ref }}
+          tag: ${{ inputs.tag || github.ref }}
 
       - name: Attest Build Provenance
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: "appimageupdate-${{ matrix.build.NAME }}"
           subject-path: appimageupdate-${{ matrix.build.NAME }}*