fix: pin GitHub Actions by SHA

.github/actions/setup-foundry/action.yml

@@ -47,7 +47,7 @@ runs:
 
     - name: Download generated Yul
       if: inputs.download-yul == 'true' && steps.local-restore-yul.outcome != 'success'
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
       with:
         name: ${{ inputs.yul-artifact-name }}
         path: ${{ inputs.yul-artifact-path }}
@@ -102,7 +102,7 @@ runs:
 
     - name: Download difftest interpreter
       if: steps.local-restore-difftest.outcome != 'success'
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
       with:
         name: difftest-interpreter
         path: .lake/build/bin
@@ -131,7 +131,7 @@ runs:
 
     - name: Cache Foundry binaries
       id: cache-foundry
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: ~/.foundry/bin
         key: foundry-v1.5.0-linux-amd64
@@ -140,7 +140,7 @@ runs:
       if: steps.cache-foundry.outputs.cache-hit != 'true'
       id: install_foundry_primary
       continue-on-error: true
-      uses: foundry-rs/foundry-toolchain@v1
+      uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1
       with:
         version: v1.5.0
 

.github/actions/setup-lean/action.yml

@@ -92,7 +92,7 @@ runs:
     - name: Cache elan + Lean toolchain
       id: cache-elan
       if: steps.persistence.outputs.use_sticky_disks != 'true'
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: ~/.elan
         key: elan-${{ hashFiles('lean-toolchain') }}
@@ -179,7 +179,7 @@ runs:
     - name: Restore Lake packages cache
       id: cache-lake
       if: steps.persistence.outputs.use_sticky_disks != 'true' && inputs.disable-lake-cache-restore != 'true'
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: .lake
         key: ${{ steps.resolve-cache-keys.outputs.primary }}

.github/actions/setup-solc/action.yml

@@ -12,7 +12,7 @@ runs:
   steps:
     - name: Cache solc binary
       id: cache-solc
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: .cache/solc/${{ env.SOLC_VERSION }}
         key: solc-${{ env.SOLC_VERSION }}

.github/workflows/docs.yml

@@ -27,7 +27,7 @@ jobs:
       run:
         working-directory: docs-site
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -45,7 +45,7 @@ jobs:
             echo "Skipping build: newer commit detected (${latest_sha})."
           fi
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         if: github.event_name != 'push' || steps.freshness.outputs.should_build == 'true'
         with:
           node-version: 22

.github/workflows/evmyullean-fork-conformance.yml

@@ -72,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -103,7 +103,7 @@ jobs:
       issues: write
     steps:
       - name: Open or update drift issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const marker = "<!-- evmyullean-fork-conformance-failure -->";

.github/workflows/issue-intake-guard.yml

@@ -12,7 +12,7 @@ jobs:
   validate-intake:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Validate issue submission
         id: validate
@@ -37,7 +37,7 @@ jobs:
 
       - name: Comment and close invalid issue
         if: steps.validate.outputs.status != '0'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           FINDINGS: ${{ steps.validate.outputs.findings }}
         with:

.github/workflows/ocr-review.yml

@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Resolve PR context
         id: pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             let pr;
@@ -79,15 +79,15 @@ jobs:
 
       - name: Checkout trusted OCR tooling
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.repository.default_branch }}
           path: ocr-trusted
           persist-credentials: false
 
       - name: Checkout PR head
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
           ref: ${{ steps.pr.outputs.head_sha }}
@@ -110,7 +110,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
 
@@ -264,7 +264,7 @@ jobs:
 
       - name: Post OCR review
         if: steps.pr.outputs.skip != 'true' && always() && !cancelled() && steps.route.outcome == 'success' && (steps.route.outputs.should_run_ocr != 'true' || steps.ocr.outcome == 'success')
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           OCR_RESULT_PATH: ${{ runner.temp }}/ocr-result.json
           OCR_STDERR_PATH: ${{ runner.temp }}/ocr-stderr.log
@@ -283,7 +283,7 @@ jobs:
 
       - name: Upload OCR metrics
         if: steps.pr.outputs.skip != 'true' && always() && !cancelled() && steps.route.outcome == 'success' && (steps.route.outputs.should_run_ocr != 'true' || steps.ocr.outcome == 'success')
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ocr-metrics-${{ steps.pr.outputs.number }}-${{ steps.pr.outputs.head_sha }}
           path: ${{ runner.temp }}/ocr-metrics.json

.github/workflows/runner-benchmark.yml

@@ -70,7 +70,7 @@ jobs:
             uptime
           } | tee -a "$GITHUB_STEP_SUMMARY"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -140,7 +140,7 @@ jobs:
 
       - name: Upload benchmark log
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: runner-benchmark-${{ inputs.task }}-${{ runner.arch }}-${{ github.run_id }}
           path: benchmark.log

.github/workflows/runner-lean-validation.yml

@@ -73,7 +73,7 @@ jobs:
             uptime
           } | tee -a "$GITHUB_STEP_SUMMARY"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -256,7 +256,7 @@ jobs:
 
       - name: Upload validation logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: runner-lean-validation-${{ runner.arch }}-${{ github.run_id }}
           path: |