ci: pin GitHub Actions to SHA digests (fix zizmor unpinned-uses)

[lhoupert]

Pin GitHub Actions to SHA digests

Zizmor detected 13 unpinned-uses findings in .github/workflows/.

GitHub Actions referenced by tag (e.g. actions/checkout@v4) are vulnerable to tag mutation — a compromised or hijacked tag can introduce malicious code into CI runs. Pinning to a full commit SHA (e.g. actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4) eliminates this supply-chain risk.

This PR pins all workflow steps to their current SHA using pin-github-action, fixing 13 findings.

Recommended next steps

1. Enable Dependabot for github-actions to keep pinned SHAs up-to-date automatically (a companion PR will be opened for this repo).
2. Add zizmor-action for continuous workflow security scanning in CI.

References

• zizmor unpinned-uses audit
• pin-github-action

---

Generated by ds-security-scanning zizmor-cli-unpinned-uses