fix(ci): pin the release checkout action to an immutable commit

.github/workflows/release.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
       - name: Set up uv

tests/unit/test_github_release_workflow.py

@@ -5,12 +5,22 @@
 
 from __future__ import annotations
 
+import re
 from pathlib import Path
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 WORKFLOW = REPO_ROOT / ".github" / "workflows" / "release.yml"
 
 
+def test_release_workflow_pins_actions_to_immutable_commits() -> None:
+    """Actions with release write permissions must not follow mutable tags."""
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    action_refs = re.findall(r"\buses:\s*([^\s#]+)", workflow)
+
+    assert action_refs
+    assert all(re.fullmatch(r"[^@]+@[0-9a-f]{40}", ref) for ref in action_refs)
+
+
 def test_release_workflow_publishes_only_labeled_merged_main_prs() -> None:
     """The PR label is the sole release-qualification signal."""
     workflow = WORKFLOW.read_text(encoding="utf-8")