ci(onnx): build a pinned commit, not a movable tag, and drop the token

Two review findings applied, one declined on the measurement.

**Build the commit, not the tag.** `v1.27.1` upstream is a *lightweight*
tag: it points straight at a commit and can be moved by anyone with push
rights there. Building from it means attesting an artifact to "whatever
that tag meant this morning" — which is exactly the property this
workflow exists to provide, so the tag undercut its own point.

`SOURCE_COMMIT` now sits beside `VERSION` in `fetch-onnxruntime.mjs`, so
the single source of truth stays single, and a step fails the build if
the tag no longer resolves to it. That catches both a repointed tag and a
`VERSION` bump whose commit was forgotten. The source commit is printed
in the job summary beside the digest, so whoever adopts the artifact can
see what it was built from.

**`persist-credentials: false` on both checkouts.** This job compiles
third-party source in the same workspace, and leaving the token in
`.git/config` puts it within reach of ONNX Runtime's own build scripts —
in a workflow holding `attestations: write`. `build.yml`, `docs.yml` and
`nix-build.yml` already set this; the omission was mine.

**Raising `timeout-minutes` above 227 is declined.** That number is from
the run with bare `--parallel`, which swapped instead of compiling. With
the parallelism bounded the whole job takes **30 minutes**, verified end
to end. 150 is already five times the observed duration, and a cap set
above a known-pathological run cannot do the job a cap is for.

Author: EtienneLescot

.github/workflows/build-onnxruntime-macos.yml

@@ -66,6 +66,12 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # This job compiles third-party source in the same workspace. Leaving the
+          # token in .git/config would put it within reach of ONNX Runtime's own build
+          # scripts — and this workflow holds `attestations: write`. Same setting
+          # build.yml, docs.yml and nix-build.yml already use.
+          persist-credentials: false
 
       - name: Read the pinned version from fetch-onnxruntime.mjs
         id: pin
@@ -77,8 +83,11 @@ jobs:
           set -euo pipefail
           VERSION="$(sed -n 's/^const VERSION = "\(.*\)";$/\1/p' scripts/fetch-onnxruntime.mjs)"
           [ -n "$VERSION" ] || { echo "::error::VERSION not found in scripts/fetch-onnxruntime.mjs"; exit 1; }
+          COMMIT="$(sed -n 's/^const SOURCE_COMMIT = "\(.*\)";$/\1/p' scripts/fetch-onnxruntime.mjs)"
+          [ -n "$COMMIT" ] || { echo "::error::SOURCE_COMMIT not found in scripts/fetch-onnxruntime.mjs"; exit 1; }
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Building ONNX Runtime v$VERSION"
+          echo "commit=$COMMIT" >> "$GITHUB_OUTPUT"
+          echo "Building ONNX Runtime v$VERSION at $COMMIT"
 
       - name: Read the deployment floor from electron-builder.json5
         id: floor
@@ -95,10 +104,28 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: microsoft/onnxruntime
-          ref: v${{ steps.pin.outputs.version }}
+          # The COMMIT, not the tag. `v1.27.1` upstream is a lightweight tag — it points
+          # straight at a commit and can be moved. Building from a tag would mean
+          # attesting an artifact to "whatever that tag meant this morning", which is
+          # precisely the property this workflow exists to provide.
+          ref: ${{ steps.pin.outputs.commit }}
           path: onnxruntime-src
           submodules: recursive
           fetch-depth: 1
+          persist-credentials: false
+
+      - name: Check the pinned commit is still what the tag names
+        # Not fatal to the build — the commit above is what gets built either way — but a
+        # tag that has moved means the pin and the version string no longer describe the
+        # same thing, and somebody should look before adopting the artifact.
+        run: |
+          set -euo pipefail
+          TAGGED="$(git -C onnxruntime-src ls-remote https://github.com/microsoft/onnxruntime "refs/tags/v${{ steps.pin.outputs.version }}" | cut -f1)"
+          if [ "$TAGGED" != "${{ steps.pin.outputs.commit }}" ]; then
+            echo "::error::v${{ steps.pin.outputs.version }} now resolves to ${TAGGED:-nothing}, not the pinned ${{ steps.pin.outputs.commit }}"
+            exit 1
+          fi
+          echo "v${{ steps.pin.outputs.version }} still resolves to ${{ steps.pin.outputs.commit }}"
 
       - name: Read the runner image
         id: image
@@ -241,6 +268,8 @@ jobs:
           {
             echo "## ONNX Runtime ${V}, macOS arm64, deployment target ${{ steps.floor.outputs.floor }}"
             echo ""
+            echo "- Source: microsoft/onnxruntime@\`${{ steps.pin.outputs.commit }}\`"
+            echo ""
             echo "- Result: ${{ job.status }}"
           } >> "$GITHUB_STEP_SUMMARY"
           if [ "${{ steps.attest.outcome }}" != "success" ]; then

scripts/fetch-onnxruntime.mjs

@@ -52,6 +52,18 @@ const ROOT = path.join(__dirname, "..");
  * direction to fail in.
  */
 const VERSION = "1.27.1";
+
+/**
+ * The upstream commit `v${VERSION}` pointed at when it was reviewed.
+ *
+ * `v1.27.1` is a LIGHTWEIGHT tag — it points straight at a commit and can be moved by
+ * anyone with push rights upstream. Nothing here fetches source at install time, so this
+ * does not affect `npm run fetch:onnxruntime`; it matters to
+ * `.github/workflows/build-onnxruntime-macos.yml`, which builds the library and would
+ * otherwise attest an artifact to "whatever that tag meant that morning". The workflow
+ * resolves the tag and refuses to build if it no longer resolves here.
+ */
+const SOURCE_COMMIT = "df2ba1cf8108aa63627cf4cdf8f807880b938616";
 const BASE = `https://github.com/microsoft/onnxruntime/releases/download/v${VERSION}`;
 
 /**