Merge pull request #342 from fabio-rovai/land/oo-2026-10-28

Land #317, #337, #338 and fixes for #333, #334, #336, #339, #340, #341

Author: fabio-rovai

.github/workflows/benchmark.yml

@@ -8,14 +8,14 @@ jobs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - uses: actions/setup-java@v4
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: 'temurin'
           java-version: '21'
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
       - name: Install Python deps
@@ -33,7 +33,7 @@ jobs:
           export OO_BIN=./target/release/open-ontologies
           cd benchmark/reasoner && bash run_lubm_performance.sh
       - name: Upload results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: benchmark-results
           path: benchmark/reasoner/results/

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_PROFILE_DEV_DEBUG: 0
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Free disk space
         if: runner.os == 'Linux'
         run: |
@@ -40,7 +40,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           # Save the build cache even when the job fails. The default discards
           # it, and these jobs fail most often on a lint or a single test leg
@@ -119,7 +119,7 @@ jobs:
     name: paths / windows-safe
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Reject paths Windows cannot check out
         run: |
           bad=$(git ls-files -z | tr '\0' '\n' \
@@ -174,7 +174,7 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_PROFILE_DEV_DEBUG: 0
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Free disk space
         run: |
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/share/powershell /usr/local/share/chromium /usr/local/share/edge
@@ -210,7 +210,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           # Save the build cache even when the job fails. The default discards
           # it, and these jobs fail most often on a lint or a single test leg
@@ -279,9 +279,9 @@ jobs:
       PYSHACL_VERSION: "0.40.1"
       RDFLIB_VERSION: "7.6.0"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           # Save the build cache even when the job fails. The default discards
           # it, and these jobs fail most often on a lint or a single test leg
@@ -291,7 +291,7 @@ jobs:
           # after a full build, and the lean job rebuilt a release binary from
           # cold for twelve minutes on a rerun that changed one line.
           cache-on-failure: true
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.11'
       - name: Install the pinned oracle
@@ -307,7 +307,7 @@ jobs:
             --json shacl-differential.json
       - name: Upload the report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: shacl-differential
           path: shacl-differential.json
@@ -345,9 +345,9 @@ jobs:
     env:
       CARGO_INCREMENTAL: 0
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'   # the floor declared by requires-python
       # The Lean checker. Same action and same inputs as the `lean` job; building
@@ -359,7 +359,7 @@ jobs:
       # second is the one that decides the job, so a real proof failure still
       # fails it, only later.
       - id: lean1
-        uses: leanprover/lean-action@v1
+        uses: leanprover/lean-action@24581d74d674803a25a81b10b059c5c0cdd344c6 # v1.6.2
         continue-on-error: true
         with:
           lake-package-directory: lean
@@ -370,15 +370,15 @@ jobs:
       - if: steps.lean1.outcome == 'failure'
         run: sleep 90
       - if: steps.lean1.outcome == 'failure'
-        uses: leanprover/lean-action@v1
+        uses: leanprover/lean-action@24581d74d674803a25a81b10b059c5c0cdd344c6 # v1.6.2
         with:
           lake-package-directory: lean
           build: true
           test: false
           lint: false
           use-github-cache: true
       - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           # Save the build cache even when the job fails. The default discards
           # it, and these jobs fail most often on a lint or a single test leg
@@ -455,8 +455,8 @@ jobs:
     name: studio (typecheck)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           cache: npm
@@ -493,14 +493,14 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_PROFILE_DEV_DEBUG: 0
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       # releases.lean-lang.org has dropped TLS connections for minutes at a
       # time (19 Oct 2026: every python and lean job failed fetching the
       # toolchain, with no code at fault). The first attempt may fail; the
       # second is the one that decides the job, so a real proof failure still
       # fails it, only later.
       - id: lean2
-        uses: leanprover/lean-action@v1
+        uses: leanprover/lean-action@24581d74d674803a25a81b10b059c5c0cdd344c6 # v1.6.2
         continue-on-error: true
         with:
           lake-package-directory: lean
@@ -511,15 +511,15 @@ jobs:
       - if: steps.lean2.outcome == 'failure'
         run: sleep 90
       - if: steps.lean2.outcome == 'failure'
-        uses: leanprover/lean-action@v1
+        uses: leanprover/lean-action@24581d74d674803a25a81b10b059c5c0cdd344c6 # v1.6.2
         with:
           lake-package-directory: lean
           build: true
           test: false
           lint: false
           use-github-cache: true
       - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           # Save the build cache even when the job fails. The default discards
           # it, and these jobs fail most often on a lint or a single test leg
@@ -837,7 +837,7 @@ jobs:
       # test fails on any row at all.
       - name: Cache Poly/ML
         id: polyml
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/polyml
           key: polyml-5.9.2-2-${{ runner.arch }}
@@ -939,7 +939,9 @@ jobs:
   # and no named PASS may regress against tests/w3c_shacl_baseline.json, in each
   # of two columns: the (focus, source shape, component) set, 61 of 120 PASS on
   # 24 Oct 2026, and the full tuple with path, value and severity as a multiset,
-  # 51 of 120 (#319; 12 before #318 put sh:value on default-path results).
+  # 53 of 120 on 28 Oct 2026 (#319; 12 before #318 put sh:value on default-path
+  # results, 51 before #333 fixed the sh:or datatype false negative, 52 before
+  # #334 kept a custom severity's namespace).
   # Pretending otherwise would be exactly the silent success
   # this repository keeps finding elsewhere. See the module docs in
   # tests/w3c_shacl_conformance_test.rs.
@@ -956,9 +958,9 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_PROFILE_DEV_DEBUG: 0
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           # Save the build cache even when the job fails. The default discards
           # it, and these jobs fail most often on a lint or a single test leg
@@ -979,7 +981,7 @@ jobs:
         run: OO_REQUIRE_FIXTURES=1 cargo test --test shacl_validation_report_w3c_test -- --nocapture
       - name: Upload the per-test report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: w3c-shacl-conformance
           path: w3c-shacl-conformance.log

.github/workflows/demo-artifacts.yml

@@ -4,7 +4,7 @@ jobs:
   manifest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Verify committed artifacts match their manifest
         run: cd demo/precomputed && shasum -a 256 -c MANIFEST.sha256
       # MANIFEST.sha256 only proves each committed file matches its OWN

.github/workflows/docker.yml

@@ -26,7 +26,7 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_PROFILE_RELEASE_DEBUG: 0
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Only on a tag push, where this workflow publishes an image. A tag that
       # does not carry its own version produces an image whose binary reports
@@ -42,15 +42,15 @@ jobs:
           df -h
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       # Build into the local daemon first so the image can be smoke-tested
       # before anything is pushed. A plain build only proves the layers
       # assemble; running the binary proves the dynamic linker can resolve
       # every shared library, which is exactly what was missing in issue #59
       # (libz.so.1). Nothing validated the published image before this.
       - name: Build image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           load: true
@@ -63,7 +63,7 @@ jobs:
 
       - name: Log in to GHCR
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -72,7 +72,7 @@ jobs:
       - name: Extract metadata
         if: startsWith(github.ref, 'refs/tags/v')
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -82,7 +82,7 @@ jobs:
 
       - name: Push image
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           push: true

.github/workflows/python-release.yml

@@ -18,15 +18,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
       - name: Build wheel + sdist
         working-directory: python
         run: uv build
       - name: Check metadata
         working-directory: python
         run: uvx twine check dist/*
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: dist
           path: python/dist/
@@ -38,9 +38,9 @@ jobs:
     permissions:
       id-token: write          # OIDC token for Trusted Publishing; no secret needed
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3