ci: pin GitHub Actions to commit SHAs

[davidberenstein1957]

Description

Pins every third-party GitHub Action in this repository to a full commit SHA and keeps the release tag as a trailing comment, for example uses: actions/checkout@<sha> # v4.2.2. This resolves the Semgrep github-actions-mutable-action-tag findings that Bastion reports for this repository.

Whoever controls an action can move a tag such as @v4 to different code, which is how the tj-actions/changed-files compromise (CVE-2025-30066) reached other repositories' workflows. A commit SHA cannot be moved.

Each SHA is the commit its existing tag points to today, so action versions do not change unless noted below.

tj-actions/changed-files@v47 is pinned to the commit behind v47.0.0. v47 was released after the fix for CVE-2025-30066, the March 2025 compromise of that action.

Related Issue

N/A

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactor (no functional change)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Testing

Generated with pinact 5.0.0 (pinact run over .github/workflows and .github/actions). A grep confirms that no uses: line for a remote action is left without a 40-character SHA. The workflows this PR touches run in CI here.

• I added or updated tests covering my changes (N/A, CI configuration only)
• Existing tests pass locally (uv run pytest -m "cpu and not slow") (N/A, no code changes)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code, especially for agent-assisted changes
• I updated the documentation where necessary (N/A)

Commits:

• 729b16e ci: pin GitHub Actions to commit SHAs