README front door: 20s landing, 3 case studies, FP policy page, C# gallery pairs, CI SHA-pinning

.github/workflows/ci.yml

@@ -1,8 +1,12 @@
 name: CI
 
 # Least privilege: every job only reads the repo (no job pushes or needs write).
-# Action SHA-pinning / persist-credentials hardening is deliberately deferred to
-# a Dependabot/hardening pass — see README "Where it cheats" item #7.
+# Every third-party `uses:` is pinned to a commit SHA (with a `# vN` comment for
+# the human-readable version) — see README "Where it cheats" item #7. (The local
+# `uses: ./` composite-action references are this repo's own action, not a
+# pinnable external dependency.) `persist-credentials: false` is a separate,
+# still-open hardening item (no job pushes or has secrets, so the exposure is
+# checkout-token-lifetime only).
 permissions:
   contents: read
 
@@ -20,8 +24,8 @@ jobs:
     name: lint (ruff + mypy --strict)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
       - name: Install linters
@@ -56,9 +60,10 @@ jobs:
       run:
         working-directory: rust
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master, 2026-07-10
         with:
+          toolchain: stable
           components: rustfmt, clippy
       - name: cargo fmt --check
         run: cargo fmt --check
@@ -75,8 +80,8 @@ jobs:
     name: audit aggregation selftests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
       - name: Install audit deps (PyYAML, audit-scoped)
@@ -102,10 +107,10 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -121,8 +126,8 @@ jobs:
     name: extended codegen fuzz
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
       - name: Property fuzz (50k draws, rotating seed)
@@ -136,11 +141,11 @@ jobs:
     name: golden C# compiles & runs (.NET)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: "8.0.x"
       - name: Check the emitted method is still in sync with the golden host
@@ -158,11 +163,11 @@ jobs:
     name: C# leak extractor (Roslyn) -> OwnIR -> core
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: "8.0.x"
       - name: Extract OwnIR facts from sample C#
@@ -864,6 +869,52 @@ jobs:
             if echo "$out" | grep -q "'$ok'"; then echo "FAIL: D5.2 silent case '$ok' was reported"; exit 1; fi
           done
           echo "OK: flow-sensitive OWN001/002/003 on real C# (path-sensitive, loops via while/foreach/for, try/finally sequential, never-vs-every-path wording, dispose-optional exempt, beyond flat)"
+      - name: Gallery C#-native bad/ok pairs (examples/gallery/cs/)
+        run: |
+          # C#-native mirror of examples/gallery/*.own, run through the real extractor ->
+          # OwnIR -> core (not the toy .own DSL's own dataflow) — see
+          # examples/gallery/cs/README.md for the 7-of-12 mapping and why the remaining 5
+          # (move/borrow/stack-buffer/unknown-call) have no real C# detector yet.
+          dotnet run --project frontend/roslyn/OwnSharp.Extractor -- \
+            examples/gallery/cs --flow-locals -o "$RUNNER_TEMP/gallery.json"
+          set +e
+          out=$(python -m ownlang ownir "$RUNNER_TEMP/gallery.json")
+          rc=$?
+          set -e
+          echo "$out"
+          # own-check's contract: 0 clean, 1 findings (the expected outcome here — the
+          # .bad.cs files are SUPPOSED to trip a finding), >=2 a hard error (bad facts /
+          # drifted contract) that must fail loudly, not be swallowed as "no findings".
+          if [ "$rc" -ge 2 ]; then
+            echo "FAIL: ownir hard error (rc=$rc) — bad OwnIR facts or a drifted contract"; exit 1
+          fi
+          echo "$out" | grep -qE "01_leak_on_error_path\.bad\.cs:[0-9]+:.*\[OWN001\].*'galleryLeakOnError'" \
+            || { echo "FAIL: expected OWN001 on galleryLeakOnError"; exit 1; }
+          echo "$out" | grep -qE "02_use_after_release\.bad\.cs:[0-9]+:.*\[OWN002\].*'galleryUseAfterRelease'" \
+            || { echo "FAIL: expected OWN002 on galleryUseAfterRelease"; exit 1; }
+          echo "$out" | grep -qE "03_double_release\.bad\.cs:[0-9]+:.*\[OWN003\].*'galleryDoubleRelease'" \
+            || { echo "FAIL: expected OWN003 on galleryDoubleRelease"; exit 1; }
+          echo "$out" | grep -qE "07_use_after_handoff\.bad\.cs:[0-9]+:.*\[OWN002\].*'galleryHandoff'" \
+            || { echo "FAIL: expected OWN002 on galleryHandoff (use after handoff)"; exit 1; }
+          echo "$out" | grep -qE "10_leak_in_loop\.bad\.cs:[0-9]+:.*\[OWN001\].*'galleryLoopLeak'" \
+            || { echo "FAIL: expected OWN001 on galleryLoopLeak"; exit 1; }
+          echo "$out" | grep -qE "11_overspan_full_view\.bad\.cs:[0-9]+:.*\[OWN025\].*'galleryOverspanBuf'" \
+            || { echo "FAIL: expected OWN025 on galleryOverspanBuf"; exit 1; }
+          for ok in galleryClean galleryLeakOnErrorOk galleryUseAfterReleaseOk galleryDoubleReleaseOk galleryHandoffOk galleryLoopLeakOk galleryOverspanOkBuf; do
+            if echo "$out" | grep -q "'$ok'"; then echo "FAIL: clean gallery case '$ok' was reported"; exit 1; fi
+          done
+          # Stronger silence check: the ok/clean fixture FILES themselves must never
+          # appear as a flagged location, not just the variable names we happened to
+          # anticipate above (an unexpected finding on some other identifier in one of
+          # these files would otherwise slip through the name-only loop).
+          for f in 00_ok_clean.cs 01_leak_on_error_path.ok.cs 02_use_after_release.ok.cs \
+                   03_double_release.ok.cs 07_use_after_handoff.ok.cs 10_leak_in_loop.ok.cs \
+                   11_overspan_full_view.ok.cs; do
+            if echo "$out" | grep -q "$f:"; then
+              echo "FAIL: clean fixture '$f' was flagged"; exit 1
+            fi
+          done
+          echo "OK: examples/gallery/cs/ bad/ok pairs match the .own gallery's codes 1:1 on the real extractor pipeline"
       - name: P-005 D5.4 T4 wrap/adopt (--flow-locals)
         run: |
           # The extractor recognises a first-party wrapper that ADOPTS a disposable arg into an
@@ -1076,8 +1127,8 @@ jobs:
     name: OwnTS (React useEffect) -> OwnIR -> core
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
       - name: Pin the spike (leaky=3xOWN001+EFF001, clean=0, showcase=2xEFF001)
@@ -1198,11 +1249,11 @@ jobs:
     name: own-check repo scan (github + msbuild) + composite action
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: "8.0.x"
       - name: GitHub-annotation format over the sample tree (directory walk)
@@ -1301,7 +1352,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Own.NET leak check (SARIF surface)
         id: own
         uses: ./
@@ -1317,7 +1368,7 @@ jobs:
           test -s "$f" || { echo "FAIL: sarif-file '$f' is missing or empty"; exit 1; }
           echo "OK: action wrote $(wc -c < "$f") bytes to $f"
       - name: Upload to GitHub code scanning
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         with:
           sarif_file: ${{ steps.own.outputs.sarif-file }}
           category: own-net-samples
@@ -1332,11 +1383,11 @@ jobs:
     name: P-014 Tier B — external reference resolution (--ref-dir)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: "8.0.x"
       - name: Materialize a third-party reference (CommunityToolkit.Mvvm 8.2.2, pinned)
@@ -1395,11 +1446,11 @@ jobs:
     name: corpus benchmark (real C# recall + specificity)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: "8.0.x"
       # Some corpus cases subscribe to framework events (WPF Window, Microsoft.Win32

.github/workflows/mine-on-push.yml

@@ -23,11 +23,11 @@ jobs:
     name: mine (sentinel)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: "8.0.x"
       - name: Materialize WPF reference assemblies (WPF profile)
@@ -94,7 +94,7 @@ jobs:
           fi
       - name: Upload the report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: mine-report
           path: |

.github/workflows/mine.yml

@@ -30,11 +30,11 @@ jobs:
     name: mine ${{ inputs.repo }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: "8.0.x"
       - name: Mine the target
@@ -65,7 +65,7 @@ jobs:
           fi
       - name: Upload the report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: mine-report
           path: |

.github/workflows/oracle.yml

@@ -57,11 +57,11 @@ jobs:
     name: oracle ${{ inputs.repo }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: "8.0.x"
 
@@ -182,15 +182,15 @@ jobs:
       # default code-scanning (security) suite — so request security-and-quality,
       # else CodeQL silently contributes zero. Comparator filters to the leak family.
       - name: CodeQL init
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         continue-on-error: true
         with:
           languages: csharp
           build-mode: none
           source-root: target
           queries: security-and-quality
       - name: CodeQL analyze
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         continue-on-error: true
         with:
           category: ownnet-oracle
@@ -243,7 +243,7 @@ jobs:
           fi
       - name: Run Infer#
         if: env.BUILD_OK == '1'
-        uses: microsoft/infersharpaction@v1.5
+        uses: microsoft/infersharpaction@b749060de518f410f92c87d37d2366e5e9d7c5fc # v1.5
         continue-on-error: true
         with:
           binary-path: _bin
@@ -281,7 +281,7 @@ jobs:
           fi
       - name: Upload the report and raw outputs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: oracle-report
           path: |

.github/workflows/pr-issue-validation.yml

@@ -32,8 +32,8 @@ jobs:
     name: validate contribution format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"