chore: pin GitHub Actions to commit SHAs

[psd-coder]

Overview

Pins all GitHub Actions workflow dependencies to specific commit SHAs instead of mutable version tags.

Problem Statement

Using mutable version tags (e.g. actions/checkout@v6) in CI workflows is a supply chain security risk — a compromised or force-updated tag could silently execute different code. Pinning to commit SHAs ensures the exact code that was reviewed is always what runs.

Solution Approach

• Replaced all @vX.Y.Z tag references with their corresponding commit SHAs across all workflow files and the shared prepare-runner composite action
• Retained the original version tag as an inline comment for human readability

Breaking Changes

None.

[github-actions]

size-limit report 📦

Path	Size
.size-check/index.mjs	2.35 KB (0%)
.size-check/render.mjs	410 B (0%)
.size-check/context.mjs	402 B (0%)