chore(ci): pin actions/setup-node to immutable SHA

[Skiipy11]

Summary

• Pin actions/setup-node@v5 → full 40-hex SHA in ci.yml and publish.yml.
• actions/checkout already SHA-pinned.

Why

Public flagship; publish.yml holds NPM_TOKEN + id-token:write — highest supply-chain exposure in the estate.

Test plan

• CI green on this PR
• grep uses: shows only 40-hex-pinned action refs

Summary by CodeRabbit

• Chores
  • Updated automated workflows to use a fixed version of the Node.js setup action, improving build and publishing consistency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: ZenSystemAI/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 88a3f631-2ee2-411f-8529-36465f6552af

📥 Commits

Reviewing files that changed from the base of the PR and between a3829f8 and c3149c5.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/publish.yml

---

📝 Walkthrough

Walkthrough

The CI and publishing workflows now reference actions/setup-node by a fixed commit SHA instead of the floating v5 tag. No other workflow logic or commands changed.

Changes

Workflow Action Pinning

Layer / File(s)	Summary
Pin setup-node in workflow jobs .github/workflows/ci.yml, .github/workflows/publish.yml	Both workflows replace the actions/setup-node@v5 reference with the specified commit SHA.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• ZenSystemAI/Zengram#8: Updates the same setup-node steps in both workflows.
• ZenSystemAI/Zengram#10: Modifies the setup-node step in the publishing workflow.
• ZenSystemAI/Zengram#14: Pins another GitHub Actions step in the same workflows.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: pinning actions/setup-node to an immutable SHA in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/pin-setup-node-v5

---

_{Comment @coderabbitai help to get the list of available commands.}