Fix githubactions:S7637: Pin external GitHub Actions to commit hashes #418

Summary

Sonar rule githubactions:S7637 flags external GitHub Actions referenced by mutable tags (e.g. @v4, @v1) instead of immutable commit SHAs. A compromised upstream action could silently inject malicious code into CI pipelines.

This is a real supply chain risk — see CVE-2025-30066 (tj-actions/changed-files) as a recent example.

Changes

Pin all 4 third-party actions across 3 workflow files to their full commit SHA (tag preserved as a comment for readability):

First-party actions/* refs are not flagged by Sonar (trusted prefix).

Prevention

No local linter equivalent — Sonar remains the guard. Using Renovate (already configured in this repo via dependabot.yml) to keep pinned SHAs up to date is recommended.