ci: pin third-party GitHub Actions to commit SHAs

Pins 11 action reference(s) from mutable tags to the commit SHA they
currently resolve to, keeping the tag as a trailing comment:

  uses: actions/checkout@v4
  uses: actions/checkout@11d5960  # v4

A git tag is mutable -- whoever controls the action repo can repoint v4 at
any commit, and every workflow picks it up on the next run with no change
on our side. Actions run with GITHUB_TOKEN and access to repo secrets, so
this is the same supply-chain exposure as an unpinned npm dependency, which
is what prompted this sweep. GitHub's own hardening guide recommends SHA
pinning for third-party actions.

Every SHA was verified to be the commit the declared tag currently points
at before committing.

First-party realiotech/* reusable workflows are deliberately left on their
branch: they are inside the trust boundary, and pinning them would require
a PR in every consuming repo for each shared-workflow change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: karlkeppner1

.github/workflows/golangci.yml

@@ -15,12 +15,12 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5
         with:
           go-version: '1.22.2'
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3.7.0
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc  # v3.7.0
         with:
           version: v1.60.2
           args: --timeout 10m

.github/workflows/test.yml

@@ -12,17 +12,17 @@ jobs:
   split-test-files:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
       - name: Create a file with all the pkgs
         run: go list ./... | grep -v e2e > pkgs.txt
       - name: Split pkgs into 2 files
         run: split -d -n l/2 pkgs.txt pkgs.txt.part.
       # cache multiple
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: '${{ github.sha }}-00'
           path: ./pkgs.txt.part.00
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: '${{ github.sha }}-01'
           path: ./pkgs.txt.part.01
@@ -35,25 +35,25 @@ jobs:
       matrix:
         part: ['00', '01']
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5
         with:
           go-version: '1.22.2'
-      - uses: technote-space/get-diff-action@v6.1.2
+      - uses: technote-space/get-diff-action@f27caffdd0fb9b13f4fc191c016bb4e0632844af  # v6.1.2
         with:
           PATTERNS: |
             **/**.go
             go.mod
             go.sum
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           name: '${{ github.sha }}-${{ matrix.part }}'
         if: env.GIT_DIFF
       - name: test & coverage report creation
         run: |
           cat pkgs.txt.part.${{ matrix.part }} | xargs go test -mod=readonly -timeout 30m -coverprofile=${{ matrix.part }}profile.out -covermode=atomic -tags='ledger test_ledger_mock test'
         if: env.GIT_DIFF
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: '${{ github.sha }}-${{ matrix.part }}-coverage'
           path: ./${{ matrix.part }}profile.out