chore: Pin GitHub Actions

[gjtorikian]

Summary

Pin all third-party GitHub Actions to immutable commit SHAs.

Why

Action tags (like v3, v4, main) can be moved or retagged, which means a future workflow run could execute different code than what we reviewed today. Pinning to SHAs makes the workflow supply chain deterministic and auditable, reducing the risk of action-level compromise or accidental breaking changes. We can still update intentionally by bumping the SHA.

[greptile-apps]

Greptile Summary

Pins all GitHub Actions (actions/checkout, actions/setup-dotnet, actions/setup-node) to immutable commit SHAs with version comments for supply chain security. This ensures workflows execute deterministic, auditable code that cannot be retroactively modified through tag manipulation.

• Replaced mutable version tags (e.g., @v4) with commit SHAs across all workflow files
• Added inline comments (e.g., # v4.3.1) to indicate which version each SHA represents
• Improves supply chain security by preventing potential action-level compromise or unexpected breaking changes

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The changes are purely security improvements that pin third-party GitHub Actions to specific commit SHAs without modifying any functional logic. All changes follow established best practices for supply chain security.
• No files require special attention

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Pinned actions/checkout and actions/setup-dotnet to commit SHAs with version comments
.github/workflows/coana-analysis.yml	Pinned actions/checkout to commit SHA, but docker://coana/coana:latest remains unpinned
.github/workflows/coana-guardrail.yml	Pinned actions/checkout (2 instances) and actions/setup-node to commit SHAs with version comments
.github/workflows/release.yml	Pinned actions/checkout and actions/setup-dotnet to commit SHAs with version comments

_{Last reviewed commit: 53a0f50}

[greptile-apps]

_{4 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Additional Comments (1)

.github/workflows/coana-analysis.yml
The :latest Docker image tag is mutable, similar to unpinned action tags. Consider pinning to a specific digest for the same supply chain security benefits, e.g., docker://coana/coana@sha256:...