ci: pin GitHub Actions to commit SHAs

[omarshahine]

Pins every uses: in this repo's workflows to a full 40-character commit SHA, keeping the version as a trailing comment.

Why. An upstream tag retarget on a mutable major (@v7, @v4) silently changes the code that runs — including in workflows that hold production Cloudflare tokens. A SHA cannot be moved.

Why this stays maintainable. Dependabot's github-actions ecosystem is already configured in this repo, and it reads the trailing # vN comment to keep both the pin and the annotation current. Pinning without it would just freeze the actions.

How the SHAs were resolved. Each from the tag it currently points at, via gh api /repos/<owner>/<repo>/git/ref/tags/<tag>, dereferencing annotated tag objects through /git/tags/<sha> to the underlying commit. Resolved per repo, not copied between repos — different repos sit on different majors.

Verification. A wrong SHA fails at run time, not parse time, so a green run on this PR is the proof the pins resolve.

Pinned

.github/workflows/plugin-inspector.yml | 6 +++---
.github/workflows/publish-clawhub.yml | 4 ++--
.github/workflows/publish-homebrew.yml | 2 +-
.github/workflows/publish-npm.yml | 4 ++--
4 files changed, 8 insertions(+), 8 deletions(-)

🤖 Generated with Claude Code

https://claude.ai/code/session_01VDD6P9ft7DNNbrXpNWvCsk

[greptile-apps]

Greptile Summary

Pins every GitHub Action reference changed by this PR to an immutable 40-character commit SHA while retaining the major version in a trailing comment for Dependabot maintenance.

• Pins checkout consistently across plugin validation and all three publication workflows.
• Pins setup-node for plugin validation, npm publishing, and ClawHub publishing.
• Pins upload-artifact for plugin-inspector diagnostic reports.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified in the pinned workflow references.

The changes preserve each workflow's action major version and inputs while replacing mutable tags with immutable commit references; the investigated pins and configured uses showed no blocking incompatibility.

Important Files Changed

Filename	Overview
.github/workflows/plugin-inspector.yml	Pins checkout, setup-node, and upload-artifact without changing the validation job's inputs or behavior.
.github/workflows/publish-clawhub.yml	Pins checkout and setup-node while preserving the existing ClawHub publication flow.
.github/workflows/publish-homebrew.yml	Pins checkout while retaining the external tap repository and token configuration.
.github/workflows/publish-npm.yml	Pins checkout and setup-node without altering Node 24 or npm registry configuration.

_{Reviews (1): Last reviewed commit: "ci: pin GitHub Actions to commit SHAs" | Re-trigger Greptile}