LQ-3764: pin GitHub Actions to commit SHAs

[y-tsuji]

Summary

• Pin GitHub Actions references in .github/workflows to full-length commit SHAs.
• Keep the original action versions as inline comments for maintainability.
• This is intended to be a non-functional change that only makes workflow dependencies immutable.

Merge criteria

• pinact run --check --verify passes.
• Since there is no intended runtime behavior change, merge once we confirm that CI is passing or that any CI failure is unrelated to this pinning change.

Made with Cursor

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[puellanivis]

😐

[y-tsuji]

Sorry, I accidentally pushed changes from the repository in the fork to the upstream repository...