Set github actions to use commit hashes

[hsubox76]

In light of a recent vulnerability introduced in a community Github Action (none of the ones we are using), we are switching our Github Actions to use commit hashes instead of version numbers. I am leaving the official Github Actions alone (actions/) as they are officially provided by Github and if they are compromised, Github might as well be compromised.

I left comments saying which version each corresponds to. In each case I picked a commit hash representing the same version as was previously referenced, except for hashicorp/setup-terraform which was a version behind and I thought would be safe to bump to the latest. So some may be well behind the latest version, such as google-github-actions/auth, which is 2 versions behind, as I didn't think this was the time to experiment with a version bump.

I didn't add these to renovate.json ignoreDeps because maybe we should be reminded to manually update these (after giving some time to check for vulnerabilities).

Also deleted

• release-tweet.yml (we no longer send release tweets, this was never used)
• merge-release-branch.yml (experiment to create a workflow to merge release into main after each release, doesn't fit into our process well as it requires creating a PR that must be approved)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 96e9bff

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[google-oss-bot]

Size Report ¹

Affected Products

No changes between base commit (e8865f2) and merge commit (22190ff).

Test Logs

• Base (e8865f2): https://github.com/firebase/firebase-js-sdk/actions/runs/13926667775
• Merge (22190ff): https://github.com/firebase/firebase-js-sdk/actions/runs/13952977076

1. https://storage.googleapis.com/firebase-sdk-metric-reports/cmNuMTzix1.html

[google-oss-bot]

Size Analysis Report ¹

Affected Products

No changes between base commit (e8865f2) and merge commit (22190ff).

Test Logs

• Base (e8865f2): https://github.com/firebase/firebase-js-sdk/actions/runs/13926667775
• Merge (22190ff): https://github.com/firebase/firebase-js-sdk/actions/runs/13952977076

1. https://storage.googleapis.com/firebase-sdk-metric-reports/JyGJU6zD7M.html

[DellaBitta]

Could you amend the PR description to include the fact that two workflows have been deleted?

[DellaBitta]

Any reason why this one is in quotes?

[hsubox76]

It was originally in quotes, didn't want to change it. I think both syntaxes are okay but the quotes are needed if there are special characters or something, so the original author was probably being careful.

[hsubox76]

Could you amend the PR description to include the fact that two workflows have been deleted?

Added.