chore(ci): pin GitHub Actions to commit SHAs

[mishushakov]

Pins all 68 external GitHub Action references across the workflow files to full 40-character commit SHAs, each annotated with a # vX.Y.Z comment, so a compromised or force-pushed upstream tag can't silently change what runs in CI. No action versions change — every pin is the SHA that the existing tag already resolved to, so CI behavior should be identical.

Three refs were previously resolving to mutable branches rather than tags — changesets/action@v1, denoland/setup-deno@v2, and (prior to the recent pnpm 10 upgrade) pnpm/action-setup@v3 — which made them the highest-risk refs here, since the release job runs with an app token and npm/PyPI publish credentials.

Also adds the helpers:pinGitHubActionDigests Renovate preset so future action updates stay pinned by digest instead of reintroducing floating tags.

Local uses: ./.github/workflows/... reusable-workflow refs are left alone (same-repo, resolved at the caller's commit). Verified all 12 workflow files still parse as valid YAML and renovate.json5 passes prettier --check.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Workflow-only supply-chain hardening; pinned SHAs match the prior tag resolutions so runtime behavior should not change.

Overview
External uses: references in twelve workflow files now point at full commit SHAs with # vX.Y.Z comments instead of version tags or branches; same-repo reusable workflows are unchanged.

renovate.json5 adds the helpers:pinGitHubActionDigests preset so future action bumps stay digest-pinned.

^{Reviewed by Cursor Bugbot for commit 073c8f0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

LGTM — mechanical CI hardening PR with no bugs found.

Extended reasoning...

Overview

Pure CI/workflow change: replaces mutable version-tag uses: refs with full 40-character commit SHAs (each annotated with a # vX.Y.Z comment) across all 11 modified workflow files, and adds Renovate's helpers:pinGitHubActionDigests preset so future bumps stay pinned. No workflow logic, job steps, secrets handling, or permissions were changed — only the action reference format.

Security risks

This is itself a security-hardening change (defense against tag mutation / supply-chain compromise, notably for the three refs that were previously floating branches rather than tags: changesets/action, denoland/setup-deno, and previously pnpm/action-setup). I verified every pinned action is used with a consistent SHA/version pair across all files (no stray typos or mismatches), and each SHA is a well-formed 40-char hex with a plausible version comment. I do not have network access in this sandbox to independently confirm each SHA resolves to the stated tag on GitHub's servers, which is the one residual risk in a PR like this — an incorrect pin would either fail CI loudly (safe) or, in the worst case, silently pin to the wrong commit.

Level of scrutiny

Low-to-moderate. This only affects CI execution, not production/runtime code, and follows an extremely well-established, mechanical pattern (identical to what Renovate's own digest-pinning preset produces). No application logic, auth, or data handling is touched.

Other factors

The bug-hunting pass found no issues, Cursor's bot also flagged this as low risk, and the diff is a uniform, repetitive transformation applied consistently across every file with no exceptions or edge cases requiring judgment.