chore: pin third-party GitHub Actions to a commit SHA across all workflows

[misrasamuelisiguzor-oss]

Description

Workflow files likely reference actions like actions/checkout@v4 by floating tag. Pinning to a specific commit SHA (with a comment noting the version) is a supply-chain hardening best practice that prevents a compromised or force-pushed tag from silently changing CI behavior.

This is part of the CI/CD configuration under .github/workflows/, the automated gate that enforces every other guarantee this project claims to have, from ABI/contract consistency to documentation linting to coverage reporting. CONTRIBUTING.md lists specific required status checks that every PR must pass before merging, which means a gap in CI configuration doesn't just fail to catch a class of bug, it actively lets that class of bug merge to main with a green checkmark that reviewers reasonably trust.

Because CI is the one piece of the project every single contributor interacts with on every single PR, inefficiencies or blind spots here have an outsized multiplier effect: a slow or overly broad workflow wastes a small amount of time on every PR forever, and a missing check is a permanently open door for exactly the class of regression it should have caught.

Requirements and context

• Replace @vN tags with the corresponding commit SHA across .github/workflows/*.yml
• Add Dependabot config (extending chore: add dependabot config for npm and cargo dependencies #34) to keep pinned SHAs updated

Suggested execution

1. Fork the repo and create a branch

   git checkout -b chore/pin-github-actions-sha
   

2. Implement changes

• Update every workflow file under .github/workflows/

3. Test and commit

• Confirm CI still passes on a test branch after pinning

Example commit message

chore: pin GitHub Actions to commit SHAs

Guidelines

• Assignment required before starting
• PR description must include: Closes #[issue_id]
• Keep PR description professional and detailed

[kolawoleoluwaferanmi014-a11y]

@kolawoleoluwaferanmi014-a11y has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, after going through the issue description, I believe I can handle it successfully. Could you please assign it to me? Thank you!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @kolawoleoluwaferanmi014-a11y to this issue.

[escaprt]

@escaprt has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

hello can i work on this?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @escaprt to this issue.

[isaac4real-art]

@isaac4real-art has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello, this issue aligns well with my skills, and I believe I can provide an effective solution. Kindly consider assigning it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @isaac4real-art to this issue.

[Nathanpvd]

@Nathanpvd has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Can I work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Nathanpvd to this issue.

[alexatsejames-alt]

@alexatsejames-alt has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer, can you pls assign these issue to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @alexatsejames-alt to this issue.

[Victoro001-tech]

@Victoro001-tech has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I can work on this perfectly

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Victoro001-tech to this issue.

[xeexco]

@xeexco has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer, I’ve reviewed the issue and fully understand the requirements. Ready to start immediately, please assign it to me!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @xeexco to this issue.

[Teejay2696]

@Teejay2696 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would love to work on this issue I will delivery on time

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Teejay2696 to this issue.

[leadgenexpert454]

@leadgenexpert454 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer
I’d love to help out with this issue. I’ve checked the current codebase/documentation and know exactly what needs to be updated to make this clearer. I will ensure everything aligns perfectly with your existing contribution guidelines.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @leadgenexpert454 to this issue.

[Wiseman52]

@Wiseman52 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, kindly assign task. I’m confident I can take ownership of this task and deliver a well-tested solution that meets your expectations.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Wiseman52 to this issue.

[mayokun-max]

@mayokun-max has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer, I’m interested in working on this issue. Thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @mayokun-max to this issue.

[sunnykid-02]

@sunnykid-02 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’d like to work on this issue because pinning third-party GitHub Actions to immutable commit SHAs helps protect CI/CD workflows from unexpected changes to mutable action tags or branches. This provides stronger supply-chain security and makes workflow execution more reproducible.

I have experience working with GitHub Actions, CI/CD pipelines, dependency management, and repository security.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @sunnykid-02 to this issue.