ci: pin release workflow actions to commit SHAs (FEPLAT-5069)

[casper-phantom]

Closes FEPLAT-5069

Note

Low risk: The pinned SHAs are exactly what the mutable refs resolve to now, so the release job runs identical action code; the only behavior change is that upstream updates no longer arrive silently.

Summary

• Pins actions/checkout, actions/setup-node, and changesets/action in .github/workflows/release.yml to the 40-character commits their mutable refs resolve to today, with the resolved version in a trailing comment.
• changesets/action@v1 was the riskiest of the three: v1 is a branch, not a tag, so every release run executed whatever that branch head happened to be.
• No version change and no nested pinning needed: all three are JavaScript actions with no downstream uses:, so the closure is fully pinned at these three refs.

Pinned refs

• actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 (v3.7.0)
• actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 (v3.9.1)
• changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d (v1.9.0, previously the v1 branch head)

Each SHA was resolved from the upstream repository's ref API at the ref the workflow used, and each action.yml was checked for nested uses: entries (none).

Follow-up worth tracking separately

actions/checkout and actions/setup-node are on the v3 line, which declares using: node16; both upstreams are now on v7. Pinning does not make that worse, but a version bump should be its own change so a behavior regression in the release job is not tangled with the security pin.

casper-run-id: 019fd2d6-e983-78c6-b3fc-6f0de9cb446c

Summary by CodeRabbit

• Chores
  • Improved release workflow reliability by pinning build actions to specific versions.
  • Enhanced consistency and security for automated release processes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fe837378-c58d-4e11-a0cf-eb8b49c12cb9

📥 Commits

Reviewing files that changed from the base of the PR and between ff82e55 and 38e45f2.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The release workflow now pins the checkout, Node.js setup, and Changesets actions to specific commit SHAs instead of mutable version tags.

Changes

Release workflow

Layer / File(s)	Summary
Pin release workflow actions .github/workflows/release.yml	The checkout, Node.js setup, and Changesets actions now use specific commit SHAs.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes pinning release workflow actions to commit SHAs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch casper/feplat-5069-pin-github-action-shas

---

_{Comment @coderabbitai help to get the list of available commands.}