chore: pin GitHub Actions to commit SHAs

[psd-coder]

Overview

All GitHub Actions workflow dependencies are pinned to exact commit SHAs instead of mutable version tags.

Problem Statement

Using mutable version tags (e.g. @v4) in GitHub Actions is a supply chain risk — a tag can be moved to point at a different, potentially malicious commit at any time without notice. Pinning to immutable commit SHAs ensures the exact code that was audited continues to run.

Solution Approach

• Replaced actions/checkout@v4 with the SHA for v6.0.2 across all workflows
• Replaced actions/setup-node@v4 with the SHA for v6.3.0 in the shared runner action
• Replaced actions/cache@v4 with the SHA for v5.0.4 in the shared runner action
• Replaced FirebaseExtended/action-hosting-deploy@v0 with the SHA for v0.10.0 in both Firebase hosting workflows

Breaking Changes

None.

[github-actions]

Visit the preview URL for this PR (updated for commit 1595d2d):

https://harmonizer-web--pr64-pin-action-versions-pipv17rp.web.app

_{(expires Mon, 13 Apr 2026 21:22:56 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 0b46b8946d697564b3f98633c5cd230a6ede1236}