chore: pin GitHub Actions to commit SHAs

[psd-coder]

Overview

Pins all GitHub Actions dependencies to exact commit SHAs instead of mutable version tags, improving supply chain security across all CI/CD workflows.

Problem Statement

Using floating version tags (e.g. actions/checkout@v6) means workflows silently adopt any tag update, including potentially malicious ones. Pinning to commit SHAs ensures immutability — the exact code that runs is known and verified.

Solution Approach

• Replaced all @vX tag references with full commit SHA + version comment in 8 workflow files
• Actions pinned: actions/checkout, actions/setup-node, actions/upload-pages-artifact, actions/deploy-pages, andresz1/size-limit-action

Breaking Changes

None.

[github-actions]

size-limit report 📦

Path	Size
createTypedChannel	254 B (0%)
createPostMessageTransport	86 B (0%)
createEventTargetTransport	109 B (0%)