Security hardening: pin GitHub Actions to immutable commit SHAs #146
Description
Summary
Current workflows reference actions by mutable tags (for example actions/checkout@v6, actions/setup-node@v6, actions/setup-python@v6).
Risk
Mutable refs can change upstream without review, which increases CI/CD supply-chain risk.
Recommendation
Pin all GitHub Actions to immutable commit SHAs, and periodically bump them using Dependabot/Renovate.
Candidate files
.github/workflows/ci.yml.github/workflows/test.yml