chore(ci): pin actions/{download,upload}-artifact to immutable SHAs (#14001)

security(ci): pin actions/{download,upload}-artifact to immutable SHAs

Replace floating tag references (download-artifact@v4.1.7, upload-artifact@v4)
with commit SHAs plus version comments, closing the supply-chain vector
exploited in the tj-actions/changed-files 2025 incident, where a tag
rewrite by a compromised maintainer propagates to every downstream
workflow that still resolves the tag at run time.

- actions/download-artifact -> 65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
- actions/upload-artifact   -> ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

Both SHAs verified against upstream:
  gh api repos/actions/download-artifact/git/ref/tags/v4.1.7
  gh api repos/actions/upload-artifact/git/ref/tags/v4.6.2

This is Phase 1 of a broader supply-chain hardening initiative motivated
by the TanStack 2026-05-11 npm compromise; remaining phases (npm OIDC
trusted publishing, optionalDependencies whitelist lint, ecosystem-
benchmark PR isolation, etc.) land in follow-up PRs.

Author: stormslowly

.github/actions/artifact/download/action.yml

@@ -18,7 +18,7 @@ runs:
   using: composite
   steps:
     - name: Download artifact from github
-      uses: actions/download-artifact@v4.1.7
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
       if: ${{ !startsWith(runner.name, 'rspack') || inputs.force-use-github-only == 'true' }}
       with:
         name: ${{ inputs.name }}

.github/actions/artifact/upload/action.yml

@@ -28,7 +28,7 @@ runs:
         overwrite: true
 
     - name: Upload artifact to github
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}

.github/workflows/bench-rust.yml

@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload Valgrind temporary files
         if: ${{ always() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: codspeed-valgrind-tmp-${{ inputs.target }}
           path: ${{ runner.temp }}/codspeed-valgrind-tmp

.github/workflows/preview-commit.yml

@@ -79,7 +79,7 @@ jobs:
         run: pnpm i
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: artifacts
 

.github/workflows/release-canary.yml

@@ -98,7 +98,7 @@ jobs:
         run: pnpm i
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: artifacts
           pattern: bindings-*

.github/workflows/release-debug.yml

@@ -47,7 +47,7 @@ jobs:
         run: pnpm i
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: artifacts
           pattern: bindings-*

.github/workflows/reusable-build-test.yml

@@ -189,7 +189,7 @@ jobs:
 
       - name: Upload Test Reporter
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: rstest-event-reports-${{ inputs.target }}-node${{ matrix.node }}
           path: '*-report.txt'

.github/workflows/reusable-release-npm.yml

@@ -99,7 +99,7 @@ jobs:
         run: pnpm i
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: artifacts
           pattern: bindings-*