ci: enforce SHA pinning for GitHub Actions (leanprover-community#35617)

This PR adds an `ensure-sha-pinned-actions` job to the existing `actionlint.yml` workflow, using [`zgosalvez/github-actions-ensure-sha-pinned-actions`](https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions) to verify that all `uses:` references in workflow files are pinned to full 40-character commit SHAs rather than mutable tags.

We use [our fork](https://github.com/kim-em/github-actions-ensure-sha-pinned-actions/tree/improve-error-reporting) (pinned to SHA) with improved error reporting until the upstream PR is merged: zgosalvez/github-actions-ensure-sha-pinned-actions#288. The improvements are:
- Report all violations at once (upstream stops at the first per job)
- File-level annotations on errors (upstream shows generic messages)

All existing workflows already use SHA-pinned references, so this just enforces the policy going forward.

🤖 Prepared with Claude Code

Author: kim-em

.github/workflows/actionlint.yml

@@ -17,3 +17,15 @@ jobs:
         with:
           tool_name: actionlint
           fail_level: any
+
+  ensure-sha-pinned-actions:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # Using our fork's PR branch until upstream merges the improved error reporting:
+      # https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/288
+      # TODO: Update to upstream release once merged.
+      - name: Ensure all actions are pinned to SHA
+        uses: kim-em/github-actions-ensure-sha-pinned-actions@00f51cdb5bbc21f5bc873ef3a2dceef45df213af # improve-error-reporting

.github/workflows/daily.yml

@@ -314,7 +314,7 @@ jobs:
           reinstall-transient-toolchain: true
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
 
       - name: Check Mathlib using nanoda # make sure this name is consistent with "Get job status and URLs" in the notify job
         id: nanoda

.github/workflows/nightly-docgen.yml

@@ -18,7 +18,7 @@ jobs:
           rm -rf "$HOME/.cache/mathlib"
 
       - name: Checkout mathlib
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: leanprover-community/mathlib4-nightly-testing
           ref: nightly-testing-green

.github/workflows/splice_bot.yaml

@@ -9,7 +9,7 @@ permissions: {}
 jobs:
   call-splice-bot:
     if: ${{ contains(github.event.comment.body, 'splice-bot') }}
-    uses: leanprover-community/SpliceBot/.github/workflows/splice.yaml@master
+    uses: leanprover-community/SpliceBot/.github/workflows/splice.yaml@fdb442693d6f613b25d2599ad64fd87cf019b9ce # master
     with:
       # Optional override; omit to use the reusable workflow's default "master"
       base_ref: master

.github/workflows/splice_bot_wf_run.yaml

@@ -10,7 +10,7 @@ permissions: {}
 jobs:
   run-reusable:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    uses: leanprover-community/SpliceBot/.github/workflows/splice_wf_run.yaml@master
+    uses: leanprover-community/SpliceBot/.github/workflows/splice_wf_run.yaml@fdb442693d6f613b25d2599ad64fd87cf019b9ce # master
     with:
       source_workflow: ${{ github.event.workflow_run.name }}
       push_to_fork: leanprover-community/mathlib4_copy