ci: pin some dependencies by hash (#3082)

.ci/env/apt.sh

@@ -100,8 +100,23 @@ function build_sysroot {
 }
 
 function install_miniforge {
-    wget -O Miniforge3.sh "https://github.com/conda-forge/miniforge/releases/latest/download/Miniforge3-$(uname)-$(uname -m).sh"
-    sudo bash Miniforge3.sh -b -p /usr/share/miniconda
+    local platform
+    local version
+    local installer
+
+    platform="$(uname)-$(uname -m)"
+    version=$(curl -s https://api.github.com/repos/conda-forge/miniforge/releases/latest | grep -oP '"tag_name": "\K(.*)(?=")')
+    installer=Miniforge3-${version}-${platform}.sh
+
+    curl -LO "https://github.com/conda-forge/miniforge/releases/download/${version}/${installer}"
+    curl -LO "https://github.com/conda-forge/miniforge/releases/download/${version}/${installer}.sha256"
+
+    if ! sha256sum -c "${installer}.sha256"; then
+        echo "Error: SHA256 checksum verification failed."
+        exit 1
+    fi
+
+    sudo bash "${installer}" -b -p /usr/share/miniconda
     source /usr/share/miniconda/etc/profile.d/conda.sh
 }
 

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
       - name: Install MKL
         run: .ci/env/apt.sh mkl
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: 3.9
       # Miniforge is necessary in order to get Intel MPI from conda-forge for MPI examples
@@ -85,7 +85,7 @@ jobs:
       - name: oneapi/dpc examples
         run: |
             source /opt/intel/oneapi/setvars.sh
-            .ci/scripts/test.sh --test-kind examples --build-dir __release_lnx --compiler icx --interface oneapi/dpc --build-system cmake            
+            .ci/scripts/test.sh --test-kind examples --build-dir __release_lnx --compiler icx --interface oneapi/dpc --build-system cmake
       - name: daal/cpp/mpi examples
         run: |
             source /opt/intel/oneapi/setvars.sh