[chore] follow-ups omnibus: SHA-pin Actions + idiom sweep + cleanup

.github/workflows/chaos.yml

@@ -48,14 +48,14 @@ jobs:
       matrix:
         arch: [amd64, arm64]
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
       - name: Set up QEMU
         if: matrix.arch != 'amd64'
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3.7.0
         with:
           platforms: ${{ matrix.arch }}
       - name: Cross-build failure-inject for ${{ matrix.arch }}
@@ -107,8 +107,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -120,8 +120,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/chart.yml

@@ -33,8 +33,8 @@ jobs:
     name: render
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -198,8 +198,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: render
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/ci-hardware.yml.staged

@@ -48,8 +48,8 @@ jobs:
           - "dcgm"
           - "dcgm hardware"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/ci.yml

@@ -23,8 +23,8 @@ jobs:
     name: verify
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -59,8 +59,8 @@ jobs:
     name: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -90,11 +90,11 @@ jobs:
             -ldflags "-s -w -X github.com/tracecoreai/tracecore/internal/version.Version=$VERSION" \
             -o tracecore-linux-arm64 \
             ./cmd/tracecore
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: tracecore-linux-amd64
           path: tracecore-linux-amd64
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: tracecore-linux-arm64
           path: tracecore-linux-arm64

.github/workflows/codeql.yml

@@ -22,15 +22,15 @@ jobs:
       matrix:
         language: [go]
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
         with:
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/autobuild@v4
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
+      - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/govulncheck.yml

@@ -16,12 +16,12 @@ jobs:
     name: govulncheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
-      - uses: golang/govulncheck-action@v1
+      - uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee  # v1.0.4
         with:
           go-version-file: go.mod
           repo-checkout: false

.github/workflows/kernelevents-integration.yml

@@ -39,8 +39,8 @@ jobs:
         # the older entry — we want exactly two adjacent kernels.
         runner: [ubuntu-22.04, ubuntu-24.04]
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -78,7 +78,7 @@ jobs:
 
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: kernelevents-bench-results-${{ matrix.runner }}
           path: bench.txt
@@ -89,8 +89,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -138,7 +138,7 @@ jobs:
           ignore-unfixed: true
       - name: kernelevents-trivy — upload SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
         continue-on-error: true
         with:
           sarif_file: trivy-otelcol.sarif
@@ -210,8 +210,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -225,8 +225,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/nccl-fr-fuzz-nightly.yml

@@ -20,8 +20,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -35,7 +35,7 @@ jobs:
       # to f.Add() seeds.
       - name: Upload fuzz crashers (if any)
         if: failure()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: fuzz-crashers
           path: pkg/nccl/fr_parser/testdata/fuzz/

.github/workflows/pr-lint.yml

@@ -13,7 +13,7 @@ jobs:
     name: pr-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
 

.github/workflows/release.yml

@@ -273,12 +273,19 @@ jobs:
           # without this, any workflow on any branch in the repo could
           # produce a bundle that passes the verifier's identity check.
           IDENTITY_REGEXP: "^https://github.com/${{ github.repository }}/\\.github/workflows/release\\.yml@refs/tags/"
+          TAG: ${{ needs.build.outputs.tag }}
         run: |
           set -euo pipefail
+          # --certificate-github-workflow-ref pins the verify to this exact
+          # tag (not any tag-ref the regex would also match). --trigger pins
+          # the OIDC claim that this fired from a tag push, not workflow_dispatch.
+          # Both narrow strictly inside what IDENTITY_REGEXP already accepts.
           cosign verify-blob \
             --bundle "$BINARY_BASENAME.cosign.bundle" \
             --certificate-identity-regexp "$IDENTITY_REGEXP" \
             --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+            --certificate-github-workflow-ref "refs/tags/$TAG" \
+            --certificate-github-workflow-trigger 'push' \
             "$BINARY_BASENAME"
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -384,11 +391,23 @@ jobs:
           if [ "$IS_PRERELEASE" = "true" ]; then
             prerelease_flag="--prerelease"
           fi
+          # Compose release notes: reproducibility walkthrough + a Rekor
+          # transparency-log pointer for after-the-fact audit. Extracting
+          # logIndex from the bundle in-job beats hand-pulling it later.
+          notes=$(mktemp)
+          cat docs/reproducibility.md > "$notes"
+          bundle="release/tracecore_${TAG}.cosign.bundle"
+          if [ -f "$bundle" ]; then
+            logIndex=$(jq -r '.rekorBundle.Payload.logIndex // empty' "$bundle")
+            if [ -n "$logIndex" ]; then
+              printf '\n## Transparency log\n\nRekor entry: https://search.sigstore.dev/?logIndex=%s\n' "$logIndex" >> "$notes"
+            fi
+          fi
           if gh release view "$TAG" >/dev/null 2>&1; then
             gh release upload "$TAG" --clobber release/*
           else
             gh release create "$TAG" $prerelease_flag \
               --title "$TAG" \
-              --notes-file docs/reproducibility.md \
+              --notes-file "$notes" \
               release/*
           fi

Makefile

@@ -193,7 +193,7 @@ doc-check:  ## Verify test identifiers referenced in rot-prone docs exist in the
 	@scripts/doc-check.sh
 	@scripts/alert-check.sh
 
-ci: license-check generate-check vet build-tags tidy-check lint nccl-fr-rce-gate coverage-check ci-fuzz-nccl-fr govulncheck doc-check build  ## Everything CI runs. Run before opening a PR.
+ci: license-check generate-check vet build-tags tidy-check mod-verify lint nccl-fr-rce-gate coverage-check ci-fuzz-nccl-fr govulncheck doc-check build  ## Everything CI runs. Run before opening a PR.
 
 smoke: build  ## End-to-end smoke test: validate the dcgm example config, run the binary for 1.5s, kill, assert lifecycle logs appear. No hardware required; receiver degrades cleanly on macOS/CI.
 	@scripts/smoke.sh

components/exporters/stdoutexporter/stdoutexporter_test.go

@@ -152,7 +152,7 @@ func TestExporter_ConcurrentWrites_DoNotInterleave(t *testing.T) {
 	errs := make(chan error, goroutines)
 	var wg sync.WaitGroup
 	wg.Add(goroutines)
-	for i := 0; i < goroutines; i++ {
+	for range goroutines {
 		go func() {
 			defer wg.Done()
 			errs <- exp.ConsumeMetrics(t.Context(), newMetricsWith("concurrent"))

components/receivers/dcgm/cardinality_fuzz_test.go

@@ -51,7 +51,7 @@ func TestEmit_CardinalityCap_InvariantsAcrossRandomInputs(t *testing.T) {
 		pkgdcgm.FieldProfPCIeTxBytes,
 	}
 
-	for trial := 0; trial < 200; trial++ {
+	for trial := range 200 {
 		numGPUs := 1 + rng.IntN(8)                          // 1..8 GPUs
 		numFieldsPerGPU := 1 + rng.IntN(10)                 // 1..10 fields
 		capacity := 1 + rng.IntN(numGPUs*numFieldsPerGPU+5) // 1..(total+5)
@@ -62,7 +62,7 @@ func TestEmit_CardinalityCap_InvariantsAcrossRandomInputs(t *testing.T) {
 
 		samples := make([]pkgdcgm.Sample, 0, numGPUs*numFieldsPerGPU)
 		now := time.Unix(1_700_000_000, 0)
-		for g := 0; g < numGPUs; g++ {
+		for g := range numGPUs {
 			entity := pkgdcgm.Entity{
 				Kind: pkgdcgm.EntityGPU,
 				ID:   uint32(g),

components/receivers/dcgm/e2e_test.go

@@ -161,7 +161,7 @@ func TestEndToEnd_ConsumerGPU_PartialFieldSupport(t *testing.T) {
 func indexMetricsByName(t *testing.T, ms pmetric.MetricSlice) map[string]pmetric.Metric {
 	t.Helper()
 	out := make(map[string]pmetric.Metric, ms.Len())
-	for i := 0; i < ms.Len(); i++ {
+	for i := range ms.Len() {
 		m := ms.At(i)
 		out[m.Name()] = m
 	}

components/receivers/dcgm/metrics.go

@@ -539,7 +539,7 @@ func sanitizeEntityString(s string) string {
 	if len(s) > maxEntityAttrLen {
 		s = s[:maxEntityAttrLen]
 	}
-	for i := 0; i < len(s); i++ {
+	for i := range len(s) {
 		c := s[i]
 		if c < 0x20 || c == 0x7F {
 			b := make([]byte, 0, len(s))

components/receivers/dcgm/metrics_test.go

@@ -259,7 +259,7 @@ func TestEmit_CardinalityCapIsDeterministic(t *testing.T) {
 	}
 
 	first := dropMetricSnapshot(t, r, samples)
-	for i := 0; i < 49; i++ {
+	for i := range 49 {
 		got := dropMetricSnapshot(t, r, samples)
 		require.Equal(t, first, got, "scrape %d: drop selection diverged from first run", i+2)
 	}
@@ -272,12 +272,12 @@ func dropMetricSnapshot(t *testing.T, r *receiver, samples []pkgdcgm.Sample) []s
 	t.Helper()
 	_, _, _, md := r.emit(samples)
 	out := make([]string, 0)
-	for i := 0; i < md.ResourceMetrics().Len(); i++ {
+	for i := range md.ResourceMetrics().Len() {
 		rm := md.ResourceMetrics().At(i)
 		hwid, _ := rm.Resource().Attributes().Get(AttrHWID)
-		for j := 0; j < rm.ScopeMetrics().Len(); j++ {
+		for j := range rm.ScopeMetrics().Len() {
 			sm := rm.ScopeMetrics().At(j)
-			for k := 0; k < sm.Metrics().Len(); k++ {
+			for k := range sm.Metrics().Len() {
 				out = append(out, hwid.AsString()+":"+sm.Metrics().At(k).Name())
 			}
 		}

components/receivers/dcgm/pattern_replay_test.go

@@ -193,7 +193,7 @@ func TestPattern5_PCIeAER(t *testing.T) {
 	// The degraded GPU's resource attributes must carry the BDF
 	// so operators can join with dmesg AER entries.
 	foundDegradedBDF := false
-	for i := 0; i < md.ResourceMetrics().Len(); i++ {
+	for i := range md.ResourceMetrics().Len() {
 		rm := md.ResourceMetrics().At(i)
 		hwid, _ := rm.Resource().Attributes().Get(AttrHWID)
 		if hwid.AsString() != "GPU-PCI-B" {
@@ -215,13 +215,13 @@ func collectNVLinkValues(t *testing.T, md pmetric.Metrics) map[string]int64 {
 	t.Helper()
 	out := make(map[string]int64)
 	rms := md.ResourceMetrics()
-	for i := 0; i < rms.Len(); i++ {
+	for i := range rms.Len() {
 		rm := rms.At(i)
 		hwid, _ := rm.Resource().Attributes().Get(AttrHWID)
 		sms := rm.ScopeMetrics()
-		for j := 0; j < sms.Len(); j++ {
+		for j := range sms.Len() {
 			ms := sms.At(j).Metrics()
-			for k := 0; k < ms.Len(); k++ {
+			for k := range ms.Len() {
 				m := ms.At(k)
 				if m.Name() != MetricHWGPUNVLinkIO {
 					continue