support pinning nightly

.github/workflows/test.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   test:
-    name: Test ${{ matrix.version }} on ${{ matrix.os }} ${{ matrix.arch }}
+    name: Test ${{ matrix.version }}${{ matrix.nightly-tag && format(' ({0})', matrix.nightly-tag) || '' }} on ${{ matrix.os }} ${{ matrix.arch }}
     runs-on: ${{ matrix.runner }}
     strategy:
       matrix:
@@ -26,6 +26,11 @@ jobs:
             arch: x86_64
             runner: ubuntu-latest
             version: nightly-new-compiler
+          - os: Linux
+            arch: x86_64
+            runner: ubuntu-latest
+            version: nightly-new-compiler
+            nightly-tag: nightly-2026-June-27-127861d
           - os: Linux
             arch: arm64
             runner: ubuntu-24.04-arm
@@ -99,6 +104,7 @@ jobs:
         uses: ./
         with:
           version: ${{ matrix.version }}
+          nightly-tag: ${{ matrix.nightly-tag }}
 
       - name: Check Roc version
         run: roc version

README.md

@@ -16,8 +16,8 @@ Add this step to your CI workflow:
 ```yaml
 - uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
   with:
-    # Installs the latest nightly from https://github.com/roc-lang/nightlies
     version: nightly-new-compiler
+    nightly-tag: nightly-2026-June-27-127861d # remove nightly-tag to just get the latest one
 ```
 
 ### For Old Major Releases
@@ -27,7 +27,7 @@ Add this step to your CI workflow:
   with:
     version: alpha4-rolling
 ```
-> Note: we recommend using this @commit-sha way to specify the version. This makes sure that the alpha4 release can not be altered if one of our github accounts is hacked.  
+> Note: we recommend using this @commit-sha way to specify the setup-roc version. This makes sure that the alpha4 release can not be altered if one of our github accounts is hacked.  
 
 ### For Old Nightly Releases
 

action.yml

@@ -8,6 +8,10 @@ inputs:
   version:
     description: 'Version of Roc to install (e.g., "nightly", "nightly-new-compiler", "alpha4-rolling")'
     required: true
+  nightly-tag:
+    description: 'Pin to a specific nightly release tag from roc-lang/nightlies (e.g., "nightly-2026-June-27-127861d"). Only valid when version is "nightly-new-compiler". When unset, the latest nightly is used.'
+    required: false
+    default: ''
   token:
     description: 'GitHub token used to authenticate API requests (avoids rate limiting). Defaults to the workflow token.'
     required: false
@@ -22,9 +26,16 @@ runs:
         set -euo pipefail
 
         VERSION="${{ inputs.version }}"
+        NIGHTLY_TAG="${{ inputs.nightly-tag }}"
         TOKEN="${{ inputs.token }}"
         echo "Installing Roc version: $VERSION"
 
+        # The nightly-tag input only applies to nightly-new-compiler
+        if [[ -n "$NIGHTLY_TAG" && "$VERSION" != "nightly-new-compiler" ]]; then
+          echo "Error: 'nightly-tag' is only supported when version is 'nightly-new-compiler' (got version '$VERSION')"
+          exit 1
+        fi
+
         # Detect OS and architecture
         OS=$(uname -s)
         ARCH=$(uname -m)
@@ -140,15 +151,27 @@ runs:
 
         # Download Roc
         if [[ "$VERSION" == "nightly-new-compiler" ]]; then
-          # Fetch the latest release from roc-lang/nightlies and find the asset for our platform
+          # Fetch a release from roc-lang/nightlies and find the asset for our platform
           AUTH_HEADER=()
           if [[ -n "$TOKEN" ]]; then
             AUTH_HEADER=(-H "Authorization: Bearer $TOKEN")
           fi
-          DOWNLOAD_URL=$(curl -fsSL "${AUTH_HEADER[@]}" "https://api.github.com/repos/roc-lang/nightlies/releases/latest" | \
+          if [[ -n "$NIGHTLY_TAG" ]]; then
+            # Pin to a specific, immutable nightly release tag
+            echo "Pinning to nightly tag: $NIGHTLY_TAG"
+            RELEASE_API_URL="https://api.github.com/repos/roc-lang/nightlies/releases/tags/${NIGHTLY_TAG}"
+          else
+            RELEASE_API_URL="https://api.github.com/repos/roc-lang/nightlies/releases/latest"
+          fi
+          DOWNLOAD_URL=$(curl -fsSL "${AUTH_HEADER[@]}" "$RELEASE_API_URL" | \
             jq -r ".assets[] | select(.name | contains(\"${PLATFORM}\")) | select(.name | endswith(\".${ASSET_EXT}\")) | .browser_download_url")
           if [[ -z "$DOWNLOAD_URL" ]]; then
-            echo "Error: Could not find a nightly-new-compiler release for platform: $PLATFORM"
+            if [[ -n "$NIGHTLY_TAG" ]]; then
+              echo "Error: Could not find a nightly-new-compiler release for platform '$PLATFORM' under tag '$NIGHTLY_TAG'"
+              echo "Make sure the tag exists at https://github.com/roc-lang/nightlies/releases and has an asset for your platform."
+            else
+              echo "Error: Could not find a nightly-new-compiler release for platform: $PLATFORM"
+            fi
             exit 1
           fi
           SKIP_SHA_CHECK=true