Pin every GitHub Actions dependency to a verified full commit SHA

[ruvnet]

Confirmed finding

At default-branch commit c4c2d8ed94a22fbc5edd77306ce1056793eb3c07, all six workflow files use mutable major-version tags. The current tree contains 19 uses: references, including actions/checkout@v4, actions/setup-node@v4, github/codeql-action/*@v3, and Pages actions.

GitHub's secure-use guidance states that a full-length commit SHA is the only immutable way to reference an action: https://docs.github.com/en/actions/reference/security/secure-use

Existing Dependabot PRs #1 and #2 advance major tags but do not make the references immutable.

Frozen hypothesis

Replacing every external action tag with a verified full commit SHA, while preserving human-readable release comments, will reduce mutable workflow references from 19 to 0 without changing workflow behavior.

Baseline

• 6 workflow files
• 19 external uses: references
• 19 mutable tag references
• 0 full-SHA references

Acceptance

1. All 19 action references use verified 40-character SHAs from the canonical action repositories.
2. Each pin has a nearby release/tag comment for maintainability.
3. CI, CodeQL, Pages build, nightly compilation, release dry-run, and automerge-policy tests pass on the exact candidate head.
4. Checkout credentials remain disabled wherever currently disabled.
5. Workflow permissions, triggers, protected-branch behavior, and automerge policy do not broaden.
6. A regression test or scanner fails on any future non-SHA uses: value.
7. No merge or deployment occurs without explicit human approval.

This is a supply-chain provenance hardening issue, not evidence that any referenced action is currently compromised.