Audit remediation (cloud/security/perf/symmetry) + review refinements

.github/workflows/deploy-docs.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
@@ -25,15 +25,15 @@ jobs:
           echo "DISPLAY=:99" >> $GITHUB_ENV
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
 
       - name: Install mkdocs and mkdocs-material
         run: pip install mkdocs mkdocs-material
 
       - name: Set up MATLAB
-        uses: matlab-actions/setup-matlab@v2
+        uses: matlab-actions/setup-matlab@aa8bbc7b76daa63c5d456d1430cbd6cb5b626ab4 # v2
         with:
           release: 'latest'
           cache: true
@@ -43,10 +43,10 @@ jobs:
             Signal_Processing_Toolbox
 
       - name: Install MatBox
-        uses: ehennestad/matbox-actions/install-matbox@v1
+        uses: ehennestad/matbox-actions/install-matbox@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
 
       - name: Build Documentation (MATLAB)
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         with:
           command: |
             mkdir('tools');

.github/workflows/prepare-release-modular.yml

@@ -14,14 +14,14 @@ on:
 jobs:
   validate_version:
     name: Validate version number
-    uses: ehennestad/matbox-actions/.github/workflows/validate-version-job.yml@v1
+    uses: ehennestad/matbox-actions/.github/workflows/validate-version-job.yml@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
     with:
       version: ${{ inputs.version }}
       ref_name: ${{ github.ref_name }}
 
   configure_test_matrix:
     name: Configure release test matrix
-    uses: ehennestad/matbox-actions/.github/workflows/create-matrix-job.yml@v1
+    uses: ehennestad/matbox-actions/.github/workflows/create-matrix-job.yml@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
     with:
       tools_directory: tools
       needs_python: false
@@ -38,7 +38,7 @@ jobs:
         MATLABVersion: [R2024b, latest]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Start virtual display server
         if: runner.os == 'Linux'
@@ -48,7 +48,7 @@ jobs:
           echo "DISPLAY=:99" >> $GITHUB_ENV
 
       - name: Set up MATLAB
-        uses: matlab-actions/setup-matlab@v2
+        uses: matlab-actions/setup-matlab@aa8bbc7b76daa63c5d456d1430cbd6cb5b626ab4 # v2
         with:
           release: ${{ matrix.MATLABVersion }}
           products: |
@@ -57,10 +57,10 @@ jobs:
             Signal_Processing_Toolbox
 
       - name: Install MatBox
-        uses: ehennestad/matbox-actions/install-matbox@v1
+        uses: ehennestad/matbox-actions/install-matbox@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
 
       - name: Run tests
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         if: always()
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -77,7 +77,7 @@ jobs:
 
       # Save the contents of the report directory from each release into an artifact.
       - name: Save report directory
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: reports-${{ matrix.MATLABVersion }}
@@ -86,7 +86,7 @@ jobs:
   release:
     name: Package toolbox and create draft release
     needs: [test, validate_version]
-    uses: ehennestad/matbox-actions/.github/workflows/package-toolbox-job.yml@v1
+    uses: ehennestad/matbox-actions/.github/workflows/package-toolbox-job.yml@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
     with:
       version_number: ${{ needs.validate_version.outputs.version_number }}
       source_directory: src/ndi
@@ -97,6 +97,6 @@ jobs:
   verify_installation:
     name: Verify toolbox installation
     needs: [release, validate_version]
-    uses: ehennestad/matbox-actions/.github/workflows/verify-installation-job.yml@v1
+    uses: ehennestad/matbox-actions/.github/workflows/verify-installation-job.yml@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
     with:
       toolbox_name: ${{ needs.release.outputs.toolbox_name }}

.github/workflows/run-tests.yml

@@ -42,9 +42,14 @@ jobs:
   run_tests:
     name: Run tests (MATLAB ${{ inputs.matlab_release || 'latest' }})
     runs-on: ubuntu-latest
+    # matbox dependency resolution calls the GitHub API; authenticate so the
+    # requests aren't unauthenticated-rate-limited (which surfaced as webread
+    # timeouts when several jobs install in parallel).
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:      
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Start virtual display server
         if: runner.os == 'Linux'
@@ -54,7 +59,7 @@ jobs:
           echo "DISPLAY=:99" >> $GITHUB_ENV
 
       - name: Set up MATLAB
-        uses: matlab-actions/setup-matlab@v2
+        uses: matlab-actions/setup-matlab@aa8bbc7b76daa63c5d456d1430cbd6cb5b626ab4 # v2
         with:
           release: ${{ inputs.matlab_release || 'latest' }}
           cache: true
@@ -68,15 +73,15 @@ jobs:
         run: git clone https://github.com/VH-Lab/NDIcalc-vis-matlab.git ../NDIcalc-vis-matlab
 
       - name: Install MatBox
-        uses: ehennestad/matbox-actions/install-matbox@v1
+        uses: ehennestad/matbox-actions/install-matbox@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
 
       - name: Check code and upload report
-        uses: ehennestad/matbox-actions/check-code@v1
+        uses: ehennestad/matbox-actions/check-code@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
         with:
           source_directory: 'src'
 
       - name: Run tests
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         if: always()
         with:
           command: |
@@ -89,7 +94,7 @@ jobs:
             testToolboxNoCloud()
 
       - name: Restore MATLAB Path
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         if: always()
         with:
           command: |
@@ -98,20 +103,20 @@ jobs:
 
       - name: Commit SVG badges if updated
         if: always() && ( github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository )
-        uses: ehennestad/matbox-actions/push-badges@v1
+        uses: ehennestad/matbox-actions/push-badges@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
         with:
           pr-ref: ${{ github.event.pull_request.head.ref }}
           pr-repo: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Upload code coverage report to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: docs/reports/codecoverage.xml
 
       # Publish test results
       - name: Publish test results
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
         if: always()
         with:
           files: "docs/reports/test-results.xml"

.github/workflows/test-cloud-api.yml

@@ -8,10 +8,6 @@ on:
   # Allows for manually running this workflow from the Actions tab
   workflow_dispatch:
 
-  push:
-    branches:
-      - add-cloud-api-testing # todo: remove this branch when merged
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -26,10 +22,10 @@ jobs:
         environment: [prod, dev]
     steps:      
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up MATLAB
-        uses: matlab-actions/setup-matlab@v2
+        uses: matlab-actions/setup-matlab@aa8bbc7b76daa63c5d456d1430cbd6cb5b626ab4 # v2
         with:
           release: latest
           cache: true
@@ -38,10 +34,10 @@ jobs:
         run: git clone https://github.com/VH-Lab/NDIcalc-vis-matlab.git ../NDIcalc-vis-matlab
 
       - name: Install MatBox
-        uses: ehennestad/matbox-actions/install-matbox@v1
+        uses: ehennestad/matbox-actions/install-matbox@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
 
       - name: Run tests
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         if: always()
         with:
           command: |
@@ -58,12 +54,12 @@ jobs:
 
       # Publish test results
       - name: Publish test results
-        uses: mikepenz/action-junit-report@v4
+        uses: mikepenz/action-junit-report@db71d41eb79864e25ab0337e395c352e84523afe # v4
         with:
           report_paths: 'docs/reports/test-results.xml'
 
       - name: Restore MATLAB Path
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         if: always()
         with:
           command: |

.github/workflows/test-cloud-prod.yml

@@ -26,16 +26,21 @@ jobs:
   run_tests:
     name: Cloud CI ${{ matrix.part }}
     runs-on: ubuntu-latest
+    # matbox dependency resolution calls the GitHub API; authenticate so the
+    # requests aren't unauthenticated-rate-limited (which surfaced as webread
+    # timeouts when several jobs install in parallel).
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     strategy:
       fail-fast: false
       matrix:
         part: [1, 2, 3]
     steps:
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up MATLAB
-        uses: matlab-actions/setup-matlab@v2
+        uses: matlab-actions/setup-matlab@aa8bbc7b76daa63c5d456d1430cbd6cb5b626ab4 # v2
         with:
           release: latest
           cache: true
@@ -44,10 +49,10 @@ jobs:
         run: git clone https://github.com/VH-Lab/NDIcalc-vis-matlab.git ../NDIcalc-vis-matlab
 
       - name: Install MatBox
-        uses: ehennestad/matbox-actions/install-matbox@v1
+        uses: ehennestad/matbox-actions/install-matbox@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
 
       - name: Run tests
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         with:
           command: |
             setenv("NDI_CLOUD_USERNAME", "${{ secrets.NDI_CLOUD_USERNAME }}")
@@ -62,14 +67,14 @@ jobs:
 
       # Publish test results
       - name: Publish test results
-        uses: mikepenz/action-junit-report@v4
+        uses: mikepenz/action-junit-report@db71d41eb79864e25ab0337e395c352e84523afe # v4
         if: always()
         with:
           report_paths: 'docs/reports/test-results.xml'
           check_name: 'Cloud CI ${{ matrix.part }} test results'
 
       - name: Restore MATLAB Path
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         if: always()
         with:
           command: |

.github/workflows/test-symmetry.yml

@@ -15,9 +15,14 @@ jobs:
   run_tests:
     name: Run symmetry tests
     runs-on: ubuntu-latest
+    # matbox.installRequirements resolves git deps via the GitHub API;
+    # authenticate so the requests aren't unauthenticated-rate-limited
+    # (which surfaced as a webread timeout to api.github.com).
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Start virtual display server
         if: runner.os == 'Linux'
@@ -27,7 +32,7 @@ jobs:
           echo "DISPLAY=:99" >> $GITHUB_ENV
 
       - name: Set up MATLAB
-        uses: matlab-actions/setup-matlab@v2
+        uses: matlab-actions/setup-matlab@aa8bbc7b76daa63c5d456d1430cbd6cb5b626ab4 # v2
         with:
           release: latest
           cache: true
@@ -37,15 +42,15 @@ jobs:
             Signal_Processing_Toolbox
 
       - name: Install MatBox
-        uses: ehennestad/matbox-actions/install-matbox@v1
+        uses: ehennestad/matbox-actions/install-matbox@8fe220fbaec9e119ec5081eb917c8e016e275f1e # v1
 
       - name: Download test datasets
         run: |
           curl -L -o /tmp/69a8705aa9ab25373cdc6563.tgz \
             https://github.com/Waltham-Data-Science/file-passing/raw/refs/heads/main/69a8705aa9ab25373cdc6563.tgz
 
       - name: Run symmetry tests
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         with:
           command: |
             setenv("NDI_CLOUD_USERNAME", "${{ secrets.NDI_CLOUD_USERNAME }}")
@@ -92,7 +97,7 @@ jobs:
             assert(all(~[results.Failed]), "Some symmetry tests failed")
 
       - name: Restore MATLAB Path
-        uses: matlab-actions/run-command@v2
+        uses: matlab-actions/run-command@37b454c384483087929a3d652be474ba585a9659 # v2
         if: always()
         with:
           command: |