chore: Pin GitHub Actions

[gjtorikian]

Summary

Pin all third-party GitHub Actions to immutable commit SHAs.

Why

Action tags (like v3, v4, main) can be moved or retagged, which means a future workflow run could execute different code than what we reviewed today. Pinning to SHAs makes the workflow supply chain deterministic and auditable, reducing the risk of action-level compromise or accidental breaking changes. We can still update intentionally by bumping the SHA.

[greptile-apps]

Greptile Summary

This PR enhances GitHub Actions security by pinning all third-party actions to immutable commit SHAs instead of mutable tags.

Changes:

• Pinned 6 action references across 4 workflow files to specific commit SHAs
• Added version comments (e.g., # v6.0.2) to most pinned actions for easy reference
• Prevents supply chain attacks where action tags could be moved to malicious code

Security Impact:
This change makes the CI/CD pipeline deterministic and auditable, eliminating the risk of actions being silently updated to execute different code.

Confidence Score: 5/5

• This PR is completely safe to merge - it's a pure security hardening change with no functional modifications
• Perfect score because this is a security best practice with zero risk. All changes pin actions to specific SHAs, making workflows immutable and auditable. No logic changes, no new dependencies, just improved supply chain security.
• No files require special attention

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Pinned actions/checkout to SHA for v6.0.2
.github/workflows/lint-pr-title.yml	Pinned amannn/action-semantic-pull-request to SHA for v6.1.1
.github/workflows/release-please.yml	Pinned actions/create-github-app-token and googleapis/release-please-action to SHAs for v2.2.1 and v4.4.0 respectively
.github/workflows/release.yml	Pinned three actions to SHAs: rubygems/configure-rubygems-credentials, actions/checkout (v6.0.2), and ruby/setup-ruby (v1.288.0)

_{Last reviewed commit: d0cd1e4}

[greptile-apps]

_{4 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}