Security: Pin GitHub Actions to full commit SHAs

Security: Pin GitHub Actions to full commit SHAs

Problem

Our workflows currently pin GitHub Actions using mutable version tags
(for example @v5, @v6, etc.).

Version tags are mutable and may be moved to point to different commits.
In the event of a supply-chain compromise, workflows could unintentionally
execute malicious code.

Proposed fix

Pin all GitHub Actions to full-length commit SHAs while keeping the version
tag as a comment for readability.

Example:

# Before

uses: actions/checkout@v6


# After

uses: actions/checkout@<full-commit-sha> 

Actions identified

File
Action

.github/workflows/tests.yml
actions/checkout

.github/workflows/tests.yml
actions/setup-go

.github/workflows/lint.yml
actions/checkout

.github/workflows/lint.yml
actions/setup-go

.github/workflows/build-image.yml
actions/checkout

.github/workflows/build-image.yml
docker/setup-qemu-action

.github/workflows/build-image.yml
docker/setup-buildx-action

.github/workflows/build-image.yml
docker/login-action

.github/workflows/build-image.yml
docker/build-push-action

Acceptance criteria

• All GitHub Actions are pinned to full commit SHAs.


• Existing CI workflows continue to pass.


• Version comments are preserved for readability.

References

• 
  GitHub Docs : Security hardening for GitHub Actions
  
  
  More details
  
  
• 
  StepSecurity: Pinning GitHub Actions guide
  
  
  More details
  
  

---

I'd be happy to work on this and submit a PR if this is approved.
Please assign me if you'd like me to proceed.