ci: pin third-party GitHub Actions to immutable commit SHAs

[loulanyue]

Summary

Pins third-party GitHub Actions across all CI workflows to immutable commit SHAs.

Fixes #3287

Changes

Updated .github/workflows/release.yml, .github/workflows/rust-ci.yml, and .github/workflows/rust.yml to replace floating @vN action references with immutable full commit hashes while preserving the human-readable version comment:

• actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
• actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
• actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
• dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
• Swatinem/rust-cache@400e7407cfd7a091e5fbb6afec01ec146c432b7c # v2.7.7
• softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1

Verification

Passed doc source-of-truth and release readiness checks locally.

[1716775457damn]

Good security hardening — pinning floating @vn tags to immutable commit SHAs kills supply-chain risk from tag re-pointing, and keeping the human-readable version comment is the right trade-off for maintainability. One nit: since actions/checkout is pinned but the workflow itself is invoked from a fixed ref too, everything here looks consistent. Approving direction; the change closes #3287.

[1716775457damn]

Good call on pinning to immutable SHAs — floating @vN tags are rewritable, so an action author's account being compromised is enough to inject arbitrary code into a workflow that has access to release secrets. That's exactly the supply-chain vector behind the tj-actions/changed-files incident. Keeping the # v4.2.2 trailing comment is the right call too, since a bare SHA is unreadable when you're debugging a failing run.

One suggestion to keep these from going stale: enable Dependabot for the github-actions ecosystem. It rewrites the SHA and keeps the version comment in sync automatically, so you keep the security property without the manual upgrade burden.

[1716775457damn]

Two follow-ups on making the pinned state durable rather than a one-time cleanup:

A cheap CI guard would make this enforceable: a job that scans every uses: line in .github/workflows/*.yml and fails if any reference is a floating tag (@vn, @main, @master) instead of a 40-char SHA. Without it, pinning only holds until the next contributor adds an action with a floating tag and review misses it, and that regression is silent. The trailing version-comment convention can be asserted in the same check, so the SHAs stay reviewable.

One trade-off worth recording: pinning dtolnay/rust-toolchain to a SHA stops the toolchain from following the stable channel, so new stable releases are not picked up until someone bumps it. That is the right security posture here, but it moves toolchain upgrades onto a human, which is another reason to pair this with Dependabot for the github-actions ecosystem so bumps arrive as PRs instead of being forgotten.