Refactor/remove old branch caches and add actionlint (#5142)

* ci(cache): add github action to remove merged branches caches

* refactor(ci): bump github actions versions

* feat(ci): add actionlint to the github actions lint

Author: mur-me

.github/workflows/build-docker-proto-image.yaml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Checkout harmony core code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           path: harmony
           ref: ${{ github.ref }}
@@ -32,16 +32,16 @@ jobs:
           echo "full_sha=${FULL_SHA}" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 #v4.2.0
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a #v4.3.0
         with:
           platforms: arm64
           cache-image: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c #v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e #v4.3.0
 
       - name: Login to DockerHub
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 #v4.3.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f #v4.6.0 
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/ci-cache-cleanup.yaml

@@ -0,0 +1,35 @@
+# Inspired by https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manage-caches#deleting-cache-entries
+# But I've used 2 flags instead of for cycle and ignoring errors:
+#  `--all` deletes every cache matching the PR ref
+#  `--succeed-on-no-caches` - green when there is simply nothing to delete, but still allowing real errors 
+#    like auth or API failures to fail the workflow
+name: Cleanup GitHub runner caches on closed pull requests
+
+on:
+  pull_request:
+    types:
+      - closed
+
+permissions:
+  contents: read
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: write
+
+    steps:
+      - name: Cleanup PR caches
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          PR_REF: refs/pull/${{ github.event.pull_request.number }}/merge
+        run: |
+          set -euo pipefail
+          echo "Deleting caches for ${PR_REF}"
+          gh cache delete \
+            --all \
+            --ref "${PR_REF}" \
+            --succeed-on-no-caches
+          echo "Done"

.github/workflows/ci-pr.yaml

@@ -34,14 +34,14 @@ jobs:
     steps:
       - &checkout-harmony
         name: Checkout harmony
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           ref: ${{ github.sha }}
           path: go/src/github.com/harmony-one/harmony
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 #v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #v7.0.0
         with:
           go-version: '1.24.2'
           cache-dependency-path: go/src/github.com/harmony-one/harmony/go.sum
@@ -70,7 +70,7 @@ jobs:
     steps:
       - *checkout-harmony
       - name: Set up Go with race cache
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 #v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #v7.0.0
         with:
           go-version: '1.24.2'
           # Keep race-enabled build artifacts separate from the regular build cache.
@@ -118,7 +118,7 @@ jobs:
 
       - &checkout-harmony-test
         name: Checkout harmony-test
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           repository: harmony-one/harmony-test
           ref: master

.github/workflows/ci-release.yaml

@@ -48,7 +48,7 @@ jobs:
           echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
 
       - name: Checkout harmony core code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           path: harmony
           ref: refs/tags/${{ steps.resolve-tag.outputs.tag }}
@@ -84,15 +84,15 @@ jobs:
 
     steps:
       - name: Checkout harmony core code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           path: harmony
           ref: refs/tags/${{ needs.check.outputs.tag }}
           fetch-depth: 1
           persist-credentials: false
 
       - name: Set up Go with go.mod
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 #v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #v7.0.0
         with:
           go-version-file: harmony/go.mod
           # Release artifacts should not restore mutable CI/PR caches.
@@ -144,7 +144,7 @@ jobs:
 
     steps:
       - name: Checkout Dockerfile and .dockerignore
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           path: harmony
           ref: refs/tags/${{ needs.check.outputs.tag }}
@@ -184,10 +184,10 @@ jobs:
           cache-image: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c #v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e #v4.3.0
 
       - name: Login to DockerHub
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 #v4.3.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f #v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -215,7 +215,7 @@ jobs:
 
     steps:
       - name: Checkout harmony core code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           path: harmony
           ref: refs/tags/${{ needs.check.outputs.tag }}

.github/workflows/github-actions-lint.yaml

@@ -0,0 +1,44 @@
+name: GitHub Actions Security Analysis with zizmor 🌈 and actionlint 
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - '.github/workflows/**/*.yml'
+      - '.github/workflows/**/*.yaml'
+
+  pull_request:
+    branches: ["**"]
+    paths:
+      - '.github/workflows/**/*.yml'
+      - '.github/workflows/**/*.yaml'
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    steps:
+      - &checkout-repository
+        name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        with:
+          inputs: ./.github/
+          advanced-security: false
+
+  actionlint:
+    name: Run actionlint
+    runs-on: ubuntu-latest
+    steps:
+      - *checkout-repository
+      - name: Run actionlint # Docu: https://github.com/rhysd/actionlint/blob/main/docs/usage.md#docker
+        uses: docker://rhysd/actionlint@sha256:9d36088643581e728c969f35141f88139fec77280b2be23c1f66f8e40e1025e7 #v1.7.12

.github/workflows/mesh-cli-release-check.yaml

@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout harmony
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           persist-credentials: false