fix(ci): pin third-party actions to full commit SHAs

[hyperpolymath]

fix(ci): pin third-party actions to full commit SHAs

The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup — startup_failure, no jobs, "this workflow graph cannot be shown" — so these workflows
could not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g. actions/checkout@<sha> # v4.

dtolnay/rust-toolchain takes its toolchain from the ref itself, so those steps also gained an
explicit with: toolchain: input; without it, a SHA ref would silently lose the channel.

No behaviour is intended to change beyond the pins.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d1d71060-2d94-4429-9605-f1561d19056d

📥 Commits

Reviewing files that changed from the base of the PR and between a98e712 and 85bd7c0.

📒 Files selected for processing (2)

• .github/workflows/security.yml
• .github/workflows/verify.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: secret-scan / rust-secrets
• GitHub Check: secret-scan / gitleaks
• GitHub Check: secret-scan / shell-secrets

🔇 Additional comments (2)

.github/workflows/security.yml (1)

33-33: LGTM!

Also applies to: 36-36, 40-40

.github/workflows/verify.yml (1)

35-35: LGTM!

Also applies to: 39-39, 59-59, 72-72, 98-98, 111-111, 131-131

---

📝 Summary

Summary by CodeRabbit

• Security

  • Improved workflow security by pinning automated actions to immutable versions.

• Maintenance

  • Updated verification and security workflows without changing their existing behaviour or configuration.

Walkthrough

The workflows now pin GitHub Actions to immutable commit SHAs. Version comments remain. Step inputs, job logic, and configuration remain unchanged.

Changes

Workflow action pinning

Layer / File(s)	Summary
Pin workflow actions .github/workflows/security.yml, .github/workflows/verify.yml	actions/checkout, CodeQL actions, and actions/upload-artifact now use commit SHAs. Release versions remain in comments.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning third-party CI actions to full commit SHAs.
Description check	✅ Passed	The description explains the Actions policy requirement, SHA pinning, ref comments, and the intended lack of behaviour changes. It is directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checked the workflow trail
And found fixed pins in every rail
Checkout rests at one clear place
CodeQL follows at a steady pace
No job steps changed their face}

_{Comment @coderabbitai help to get the list of available commands.}