ci: pin GitHub Actions to commit SHAs (12)

[mirkosalvato1-ctrl]

Why

Mutable Action tags (@v4, @main) can be retagged, which is a supply-chain risk.
This PR pins third-party Actions to full commit SHAs while keeping the tag in a comment.
Official actions/* tags are left unchanged (common maintainer preference).

Pins

• pnpm/action-setup@v3 -> a3252b78c470
• actions/configure-pages@v2 -> c5a3e1159e0c
• actions/jekyll-build-pages@v1 -> 44a6e6beabd4
• actions/upload-pages-artifact@v3 -> 56afc609e742
• actions/deploy-pages@v4 -> d6db90164ac5
• pnpm/action-setup@v4 -> b906affcce14
• pnpm/action-setup@v2 -> eae0cfeb286e
• softprops/action-gh-release@v1 -> de2c0eb89ae2
• pnpm/action-setup@v4 -> b906affcce14
• pnpm/action-setup@v4 -> b906affcce14
• pnpm/action-setup@v4 -> b906affcce14
• pnpm/action-setup@v4 -> b906affcce14

Reference: GitHub docs on using third-party actions securely.

Summary by CodeRabbit

• Chores
  • Pinned automated build, test, documentation, publishing, and deployment tools to specific revisions.
  • Improved the consistency and reproducibility of automated workflows.
  • Reduced the risk of unexpected changes from moving action version tags.
  • No changes were made to application features, publishing behavior, or deployment processes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 54292308-b17f-4cf9-bd7a-6527a633d6d2

📥 Commits

Reviewing files that changed from the base of the PR and between 662006b and bdf9878.

📒 Files selected for processing (7)

• .github/workflows/auto-deploy.yml
• .github/workflows/auto-fix.yml
• .github/workflows/auto-publish.yml
• .github/workflows/build-docs.yml
• .github/workflows/build-lib.yml
• .github/workflows/dispatch-publish.yml
• .github/workflows/playwright.yml

---

Walkthrough

Seven GitHub Actions workflows replace version-tagged action references with pinned commit SHAs. Existing triggers, commands, inputs, publishing, release, and Pages deployment behavior remain unchanged.

Changes

Workflow action pinning

Layer / File(s)	Summary
Pages deployment action pins .github/workflows/auto-deploy.yml	Pins pnpm setup and GitHub Pages build, artifact, and deployment actions to commit SHAs.
Automation and publishing action pins .github/workflows/auto-fix.yml, .github/workflows/auto-publish.yml	Pins pnpm setup in autofix and publishing workflows, plus the GitHub release action in the publish workflow.
Build and test workflow pins .github/workflows/build-docs.yml, .github/workflows/build-lib.yml, .github/workflows/dispatch-publish.yml, .github/workflows/playwright.yml	Pins pnpm setup references used by documentation, library, dispatch publishing, and Playwright workflows.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit hops through workflows bright,
Pinning each action snug and tight.
Pages build and releases gleam,
Tests and docs stay on the team.
Commit by commit, the paths are clear!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: pinning GitHub Actions to commit SHAs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}