diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 4a0a5cf929b5..dc3643f27ca7 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -103,7 +103,7 @@ jobs:
       E2E_TEST_ARTIFACTS_GCS_ARTIFACT_DIR: ${{ needs.build_e2e_test_artifacts.outputs.e2e-test-artifacts-gcs-artifact-dir }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Downloading install dir archive"
@@ -169,7 +169,7 @@ jobs:
       EXECUTION_BENCHMARK_RESULTS_GCS_ARTIFACT_DIR: ${{ needs.execution_benchmarks.outputs.benchmark-results-gcs-artifact-dir }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           # We need the full history (and main branch) to generate the report.
           fetch-depth: 0
@@ -262,7 +262,7 @@ jobs:
       - process_benchmark_results
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: Getting failed jobs
         id: failed_jobs
         run: |
diff --git a/.github/workflows/benchmark_compilation.yml b/.github/workflows/benchmark_compilation.yml
index 5f9ebe149ec4..df6e9c333e62 100644
--- a/.github/workflows/benchmark_compilation.yml
+++ b/.github/workflows/benchmark_compilation.yml
@@ -70,7 +70,7 @@ jobs:
       compile-stats-results-gcs-artifact: ${{ steps.upload.outputs.compile-stats-results-gcs-artifact }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Downloading assets"
         id: "download-assets"
         env:
diff --git a/.github/workflows/benchmark_execution.yml b/.github/workflows/benchmark_execution.yml
index 2eaef4cbac34..baa1c57abbce 100644
--- a/.github/workflows/benchmark_execution.yml
+++ b/.github/workflows/benchmark_execution.yml
@@ -56,7 +56,7 @@ env:
 jobs:
   generate_matrix:
     runs-on:
-      - self-hosted  # must come first
+      - self-hosted # must come first
       - runner-group=${{ inputs.runner-group }}
       - environment=${{ inputs.runner-env }}
       - cpu
@@ -65,7 +65,7 @@ jobs:
       benchmark-matrix: ${{ steps.generate.outputs.benchmark-matrix }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Generating benchmark matrix"
@@ -118,7 +118,7 @@ jobs:
       matrix:
         benchmark: ${{ fromJSON(needs.generate_matrix.outputs.benchmark-matrix) }}
     runs-on:
-      - self-hosted  # must come first
+      - self-hosted # must come first
       - runner-group=${{ inputs.runner-group }}
       - environment=${{ inputs.runner-env }}
       - machine-type=${{ matrix.benchmark.device_name }}
@@ -136,7 +136,7 @@ jobs:
       benchmark-results-gcs-artifact-dir: ${{ env.GCS_DIR }}/${{ env.BENCHMARK_RESULTS_DIR }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Downloading benchmark tools"
diff --git a/.github/workflows/benchmark_trigger.yml b/.github/workflows/benchmark_trigger.yml
index e74cdf3feef2..9fc3de193f5a 100644
--- a/.github/workflows/benchmark_trigger.yml
+++ b/.github/workflows/benchmark_trigger.yml
@@ -25,7 +25,7 @@ env:
   HEAD_SHA: ${{ github.event.pull_request.head.sha }}
   # Target workflow that runs the benchmarks.
   WORKFLOW_NAME: Benchmark
-  BENCHMARK_LABEL_PREFIX: 'benchmarks:'
+  BENCHMARK_LABEL_PREFIX: "benchmarks:"
 
 jobs:
   # Precondition check is a separate step because we can't put the concurrency
@@ -71,7 +71,7 @@ jobs:
       - name: "Checking out repository"
         # This checkouts from the base branch instead of the pull request. See
         # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
 
       - name: "Finding the previous workflow run"
         id: find-workflow
diff --git a/.github/workflows/build_all.yml b/.github/workflows/build_all.yml
index 3a62be964c9c..7e45b5d309a7 100644
--- a/.github/workflows/build_all.yml
+++ b/.github/workflows/build_all.yml
@@ -73,7 +73,7 @@ jobs:
       install-dir-gcs-url: ${{ steps.install-upload.outputs.install-dir-gcs-url }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: "Building IREE"
diff --git a/.github/workflows/build_and_test_android.yml b/.github/workflows/build_and_test_android.yml
index d36ce257bbfd..4c5820e0c354 100644
--- a/.github/workflows/build_and_test_android.yml
+++ b/.github/workflows/build_and_test_android.yml
@@ -65,7 +65,7 @@ jobs:
       target-build-dir-gcs-artifact: ${{ steps.upload.outputs.target-build-dir-gcs-artifact }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Downloading install dir archive"
@@ -134,7 +134,7 @@ jobs:
       TARGET_BUILD_DIR_GCS_ARTIFACT: ${{ needs.cross_compile.outputs.target-build-dir-gcs-artifact }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Downloading target build archive"
         run: |
           gcloud storage cp "${TARGET_BUILD_DIR_GCS_ARTIFACT}" "${TARGET_BUILD_DIR_ARCHIVE}"
diff --git a/.github/workflows/build_benchmark_tools.yml b/.github/workflows/build_benchmark_tools.yml
index 34e08572fa5c..820c2831af51 100644
--- a/.github/workflows/build_benchmark_tools.yml
+++ b/.github/workflows/build_benchmark_tools.yml
@@ -88,7 +88,7 @@ jobs:
       INSTALL_DIR_GCS_ARTIFACT: ${{ inputs.install-dir-gcs-artifact }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Downloading install dir archive"
diff --git a/.github/workflows/build_e2e_test_artifacts.yml b/.github/workflows/build_e2e_test_artifacts.yml
index de6cf35db9d5..99378b517335 100644
--- a/.github/workflows/build_e2e_test_artifacts.yml
+++ b/.github/workflows/build_e2e_test_artifacts.yml
@@ -92,7 +92,7 @@ jobs:
       e2e-test-artifacts-build-log-gcs-artifact: ${{ steps.upload.outputs.e2e-test-artifacts-build-log-gcs-artifact }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Downloading install dir archive"
diff --git a/.github/workflows/build_package.yml b/.github/workflows/build_package.yml
index 0b7fed68fe43..d4a4cca4876e 100644
--- a/.github/workflows/build_package.yml
+++ b/.github/workflows/build_package.yml
@@ -43,7 +43,8 @@ jobs:
             build-family: linux-x86_64
             build-package: main-dist-linux
             experimental: false
-          - runs-on: [self-hosted, arm64, os-family=Linux, runner-group=postsubmit]
+          - runs-on:
+              [self-hosted, arm64, os-family=Linux, runner-group=postsubmit]
             build-family: linux-aarch64
             build-package: main-dist-linux
             experimental: true
@@ -51,7 +52,8 @@ jobs:
             build-family: linux-x86_64
             build-package: py-compiler-pkg
             experimental: false
-          - runs-on: [self-hosted, arm64, os-family=Linux, runner-group=postsubmit]
+          - runs-on:
+              [self-hosted, arm64, os-family=Linux, runner-group=postsubmit]
             build-family: linux-aarch64
             build-package: py-compiler-pkg
             experimental: true
@@ -59,7 +61,8 @@ jobs:
             build-family: linux-x86_64
             build-package: py-runtime-pkg
             experimental: false
-          - runs-on: [self-hosted, arm64, os-family=Linux, runner-group=postsubmit]
+          - runs-on:
+              [self-hosted, arm64, os-family=Linux, runner-group=postsubmit]
             build-family: linux-aarch64
             build-package: py-runtime-pkg
             experimental: true
@@ -103,9 +106,9 @@ jobs:
       MANYLINUX_AARCH64_IMAGE: quay.io/pypa/manylinux_2_28_aarch64
 
     steps:
-      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+      - uses: actions/checkout@v4.1.7
         with:
-          path: "c"  # Windows can hit path length limits, so use a short path.
+          path: "c" # Windows can hit path length limits, so use a short path.
           submodules: true
           ref: ${{ github.event.inputs.commit }}
 
diff --git a/.github/workflows/bump_torch_mlir.yml b/.github/workflows/bump_torch_mlir.yml
index 594c32761826..d039ed9ff2c7 100644
--- a/.github/workflows/bump_torch_mlir.yml
+++ b/.github/workflows/bump_torch_mlir.yml
@@ -17,9 +17,9 @@ on:
   workflow_dispatch:
     inputs:
       bump_target:
-        description: 'Commit hash or branch to bump the submodule to'
+        description: "Commit hash or branch to bump the submodule to"
         required: false
-        default: 'origin/main'
+        default: "origin/main"
   pull_request:
     branches:
       - main
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c  # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: false
 
@@ -67,9 +67,9 @@ jobs:
           base: main
           branch: integrates/torch-mlir
           delete-branch: true # automatically supercedes the previous bump
-          title: 'Bump torch-mlir submodule to ${{ steps.bump_submodule.outputs.TORCH_MLIR_COMMIT }}'
+          title: "Bump torch-mlir submodule to ${{ steps.bump_submodule.outputs.TORCH_MLIR_COMMIT }}"
           body: |
             This PR updates the torch-mlir submodule to https://github.com/llvm/torch-mlir/commit/${{ steps.bump_submodule.outputs.TORCH_MLIR_COMMIT }}.
 
             Auto-generated by GitHub Actions using `.github/workflows/bump_torch_mlir.yml`.
-          commit-message: 'Bump torch-mlir submodule to ${{ steps.bump_submodule.outputs.TORCH_MLIR_COMMIT }}'
+          commit-message: "Bump torch-mlir submodule to ${{ steps.bump_submodule.outputs.TORCH_MLIR_COMMIT }}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1c66c404e540..4085dee71c03 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,7 +78,7 @@ jobs:
       BUILD_DIR: build-arm64
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: "Building IREE"
@@ -117,7 +117,7 @@ jobs:
   #     BUILD_DIR: build-windows
   #   steps:
   #     - name: "Checking out repository"
-  #       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+  #       uses: actions/checkout@v4.1.7
   #       with:
   #         submodules: true
   #     - id: "gcp-auth"
@@ -162,7 +162,7 @@ jobs:
       BUILD_DIR: build-macos
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Updating git submodules"
         run: git submodule update --init --jobs 8 --depth 1
       - name: "Installing Python packages"
@@ -199,7 +199,7 @@ jobs:
         shell: bash
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - id: "gcp-auth"
         name: "Authenticating to Google Cloud"
         if: needs.setup.outputs.write-caches == 1
@@ -250,7 +250,7 @@ jobs:
       - os-family=Linux
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: "Building with Bazel"
@@ -282,7 +282,7 @@ jobs:
       - os-family=Linux
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: Querying GPU information
@@ -346,7 +346,7 @@ jobs:
       - os-family=Linux
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: Querying GPU information
@@ -406,7 +406,7 @@ jobs:
     runs-on: nodai-amdgpu-mi250-x86-64
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Downloading install dir archive"
@@ -445,7 +445,7 @@ jobs:
     runs-on: nodai-amdgpu-w7900-x86-64
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Downloading install dir archive"
@@ -505,7 +505,7 @@ jobs:
       CONTAINER: ${{ matrix.container }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
 
@@ -555,7 +555,7 @@ jobs:
         run: |
           docker pull ghcr.io/nod-ai/manylinux_x86_64:main &
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: "Setting up Python"
@@ -632,7 +632,7 @@ jobs:
             script: ./build_tools/cmake/build_and_test_tsan.sh
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: "Building and testing"
@@ -658,7 +658,7 @@ jobs:
       BUILD_DIR: build-runtime
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Building size-optimized runtime"
@@ -687,7 +687,7 @@ jobs:
       BUILD_DIR: build-gcc
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: "Building IREE with gcc"
@@ -715,7 +715,7 @@ jobs:
       BUILD_DIR: build-tracing
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Building IREE runtime with tracing - Tracy"
@@ -746,7 +746,7 @@ jobs:
       BUILD_DIR: build-debug
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: "Building IREE in Debug configuration"
@@ -774,7 +774,7 @@ jobs:
       - os-family=Linux
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: "Building and testing with bring-your-own-LLVM"
@@ -843,7 +843,7 @@ jobs:
       IREE_WRITE_REMOTE_CCACHE: ${{ needs.setup.outputs.write-caches }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Downloading install dir archive"
@@ -938,7 +938,7 @@ jobs:
       - build_and_test_android
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
       - name: Getting failed jobs
         id: failed_jobs
         run: |
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3e08dd2da2f2..d23608f04373 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checking out repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
       - name: Setting up python
         uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
       - name: Running pre-commit
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checking out repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
       - name: Generating CMake files
         run: |
           ./build_tools/scripts/generate_cmake_files.sh
diff --git a/.github/workflows/oneshot_candidate_release.yml b/.github/workflows/oneshot_candidate_release.yml
index 7a980fd010bd..bc99036a3f8f 100644
--- a/.github/workflows/oneshot_candidate_release.yml
+++ b/.github/workflows/oneshot_candidate_release.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checking out repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           token: ${{ secrets.WRITE_ACCESS_TOKEN }}
 
diff --git a/.github/workflows/pkgci_build_packages.yml b/.github/workflows/pkgci_build_packages.yml
index 41868ad5d9b4..2729c5597a1b 100644
--- a/.github/workflows/pkgci_build_packages.yml
+++ b/.github/workflows/pkgci_build_packages.yml
@@ -32,7 +32,7 @@ jobs:
         run: |
           docker pull "$MANYLINUX_DOCKER_IMAGE" &
       - name: Checking out repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
       - name: Write version info
@@ -48,7 +48,7 @@ jobs:
           realpath version_info.json
           cat version_info.json
       - name: Enable cache
-        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8  # v3.3.1
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
         with:
           path: ${{ env.CACHE_DIR }}
           key: iree-pkgci-linux-release-x86_64-v1-${{ github.sha }}
@@ -77,7 +77,6 @@ jobs:
           path: |
             ${{ github.workspace }}/wheelhouse/iree*.whl
           if-no-files-found: error
-
 # TODO: Debug low ccache hit rate and re-enable.
 # linux_x86_64_release_asserts_packages:
 #   name: Linux Release Asserts (x86_64)
@@ -98,7 +97,7 @@ jobs:
 #       run: |
 #         docker pull "$MANYLINUX_DOCKER_IMAGE" &
 #     - name: "Checking out repository"
-#       uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+#       uses: actions/checkout@v4.1.7
 #       with:
 #         submodules: true
 #     - name: Write version info
diff --git a/.github/workflows/pkgci_regression_test.yml b/.github/workflows/pkgci_regression_test.yml
index cbb0fa56702a..327645bf4c49 100644
--- a/.github/workflows/pkgci_regression_test.yml
+++ b/.github/workflows/pkgci_regression_test.yml
@@ -49,7 +49,7 @@ jobs:
               - self-hosted # must come first
               - runner-group=${{ github.event_name == 'pull_request' && 'presubmit' || 'postsubmit' }}
               - environment=prod
-              - gpu  # TODO(scotttodd): qualify further with vendor/model
+              - gpu # TODO(scotttodd): qualify further with vendor/model
               - os-family=Linux
           - name: nvidiagpu_vulkan
             config-file: onnx_gpu_vulkan.json
@@ -58,7 +58,7 @@ jobs:
               - self-hosted # must come first
               - runner-group=${{ github.event_name == 'pull_request' && 'presubmit' || 'postsubmit' }}
               - environment=prod
-              - gpu  # TODO(scotttodd): qualify further with vendor/model
+              - gpu # TODO(scotttodd): qualify further with vendor/model
               - os-family=Linux
     env:
       PACKAGE_DOWNLOAD_DIR: ${{ github.workspace }}/.packages
@@ -69,14 +69,14 @@ jobs:
       VENV_DIR: ${{ github.workspace }}/venv
     steps:
       - name: Checking out IREE repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: false
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1  # v4.7.0
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
-          python-version: '3.11'
-      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3.0.2
+          python-version: "3.11"
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}
@@ -87,7 +87,7 @@ jobs:
             --fetch-gh-workflow=${{ inputs.artifact_run_id }}
 
       - name: Check out external TestSuite repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           repository: nod-ai/SHARK-TestSuite
           ref: ab932cc54f1e460ccd9b4a4f1efa07d0ee069eb5
@@ -176,14 +176,14 @@ jobs:
       VENV_DIR: ${{ github.workspace }}/venv
     steps:
       - name: Checking out IREE repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: false
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1  # v4.7.0
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
-          python-version: '3.11'
-      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3.0.2
+          python-version: "3.11"
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}
@@ -204,7 +204,7 @@ jobs:
 
       # Out of tree tests
       - name: Check out external TestSuite repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           repository: nod-ai/SHARK-TestSuite
           ref: ab932cc54f1e460ccd9b4a4f1efa07d0ee069eb5
diff --git a/.github/workflows/pkgci_test_tensorflow_cpu.yml b/.github/workflows/pkgci_test_tensorflow_cpu.yml
index d1e7ae6daa36..9a050a69b6a8 100644
--- a/.github/workflows/pkgci_test_tensorflow_cpu.yml
+++ b/.github/workflows/pkgci_test_tensorflow_cpu.yml
@@ -28,14 +28,14 @@ jobs:
       IREE_VMVX_DISABLE: 0
     steps:
       - name: Checking out repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: false
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1  # v4.7.0
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
         with:
           # Must match the subset of versions built in pkgci_build_packages.
-          python-version: '3.11'
-      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3.0.2
+          python-version: "3.11"
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: linux_x86_64_release_packages
           path: ${{ env.PACKAGE_DOWNLOAD_DIR }}
diff --git a/.github/workflows/post_benchmark_comment.yaml b/.github/workflows/post_benchmark_comment.yaml
index 3b15c34d75a3..7d4dfb3c728a 100644
--- a/.github/workflows/post_benchmark_comment.yaml
+++ b/.github/workflows/post_benchmark_comment.yaml
@@ -28,7 +28,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking benchmark processing job"
         id: check
         env:
diff --git a/.github/workflows/publish_website.yml b/.github/workflows/publish_website.yml
index 6eef4b5aea3a..9999f8612698 100644
--- a/.github/workflows/publish_website.yml
+++ b/.github/workflows/publish_website.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout out repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           submodules: true
           token: ${{ secrets.WRITE_ACCESS_TOKEN }}
@@ -40,10 +40,10 @@ jobs:
         # We have to explicitly fetch the gh-pages branch as well to preserve history
         run: git fetch --no-tags --prune --depth=1 origin "gh-pages:gh-pages"
       - name: Setting up Python
-        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435  # v4.5.0
+        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
         with:
           python-version: 3.x
-          cache: 'pip'
+          cache: "pip"
       - id: "gcp-auth"
         name: "Authenticating to Google Cloud"
         uses: "google-github-actions/auth@v1"
diff --git a/.github/workflows/samples.yml b/.github/workflows/samples.yml
index d5926fac2067..1e6866765bbe 100644
--- a/.github/workflows/samples.yml
+++ b/.github/workflows/samples.yml
@@ -31,11 +31,11 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
       - name: "Setting up Python"
-        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1  # v4.7.0
+        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
       - name: "Testing Colab Notebooks"
         run: ./samples/colab/test_notebooks.py
 
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
       - name: "Checking out runtime submodules"
         run: ./build_tools/scripts/git/update_runtime_submodules.sh
       - name: "Installing build dependencies"
@@ -53,9 +53,9 @@ jobs:
           export CC=clang
           export CXX=clang++
       - name: "Setting up Python"
-        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1  # v4.7.0
+        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
       - name: "Testing Samples"
         run: ./build_tools/testing/test_samples.sh
 
@@ -70,7 +70,7 @@ jobs:
   #     HOST_BUILD_DIR: build-host-install
   #   steps:
   #     - name: "Checking out repository"
-  #       uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+  #       uses: actions/checkout@v4.1.7
   #       with:
   #         submodules: true
   #     - name: "Building host tools"
diff --git a/.github/workflows/schedule_candidate_release.yml b/.github/workflows/schedule_candidate_release.yml
index 9059becbf5de..80d17b20d9f4 100644
--- a/.github/workflows/schedule_candidate_release.yml
+++ b/.github/workflows/schedule_candidate_release.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checking out repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           token: ${{ secrets.WRITE_ACCESS_TOKEN }}
           fetch-depth: 0
diff --git a/.github/workflows/setup.yml b/.github/workflows/setup.yml
index bb877bcfa585..67403efe9646 100644
--- a/.github/workflows/setup.yml
+++ b/.github/workflows/setup.yml
@@ -57,7 +57,7 @@ jobs:
       benchmark-presets: ${{ steps.configure.outputs.benchmark-presets }}
     steps:
       - name: "Checking out repository"
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4.1.7
         with:
           # We need the parent commit to do a diff
           fetch-depth: 2
diff --git a/.github/workflows/validate_and_publish_release.yml b/.github/workflows/validate_and_publish_release.yml
index 3e060fe41e0c..578ef4a8a7b6 100644
--- a/.github/workflows/validate_and_publish_release.yml
+++ b/.github/workflows/validate_and_publish_release.yml
@@ -35,7 +35,7 @@ jobs:
           ls -R
       - name: Set up python
         id: set_up_python
-        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435  # v4.5.0
+        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0
         with:
           python-version: "3.9"
       - name: Install python packages
@@ -120,7 +120,7 @@ jobs:
           release_id: ${{ github.event.inputs.release_id }}
 
       - name: Checking out repository
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@v4.1.7
         with:
           token: ${{ secrets.WRITE_ACCESS_TOKEN }}
           # Get all history. Otherwise the latest-snapshot branch can't be