fix: pin GitHub Actions to SHA for supply chain security

[apham0001]

Summary

• Pin all GitHub Actions uses: references to commit SHAs for supply chain security
• Original version tags preserved as inline comments for maintainability
• Mitigates supply chain attacks where a compromised tag could inject malicious code (ref: Trivy incident March 2026)

Changes

• All uses: owner/action@tag → uses: owner/action@SHA # tag
• No version changes, only pinning format

Test plan

• Verify CI workflows run successfully
• Confirm no action versions changed, only pinning format

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions workflows in the repository have been updated to pin third-party actions to specific commit SHAs instead of using floating version tags. Six actions across four workflow files are now locked to exact commit references while maintaining the same v2, v3, or main labels for clarity.

Changes

Cohort / File(s)	Summary
GitHub Actions Version Pinning .github/workflows/build-deploy-obol-sdk.yml, .github/workflows/ci.yml, .github/workflows/label-issues.yml, .github/workflows/release-pr.yml	Pinned actions like actions/checkout, actions/setup-node, martinbeentjes/npm-get-version-action, ffurrer2/extract-release-notes, rickstaa/action-create-tag, ncipollo/release-action, actions/github-script, and peter-evans/create-pull-request to specific commit SHAs instead of floating version tags for improved reproducibility and security.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 Through workflows we hop with versions so tight,
Each action now pinned to commits burning bright,
No floating about on the tag-laden breeze,
Our builds are secure and flow with such ease!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: pinning GitHub Actions to commit SHAs for supply chain security, which aligns with all file modifications in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pin-github-actions-sha

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}