fix(ci): pin third-party github actions by sha (#84)

[w7-mgfcode]

Summary

• SHA-pin the three third-party GitHub Actions used across all five workflows, per .claude/rules/security-patterns.md.
• actions/checkout@v6 and actions/upload-artifact@v7 stay on major-tag (rule-permitted for first-party actions/*).
• Dependabot watches .github/workflows/ weekly and will auto-bump these forward.

Closes #84.

Changes

Action	Before	After
googleapis/release-please-action	@v5	@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
astral-sh/setup-uv (×8)	@v7	@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
github/codeql-action/upload-sarif	@v4	@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0

Total: 5 files, 11 insertions, 11 deletions. No behavior change — each SHA resolves to the same commit as the corresponding major-tag at time of writing.

Test plan

• CI on this PR passes (lint, typecheck, test, migration-check) using the newly-pinned astral-sh/setup-uv SHA
• schema-validation workflow does not trigger (no alembic/, app/**/models.py, or app/core/database.py changes here) — confirm
• No regression in cached uv installs (SHA is the current v7 head, so cache key remains compatible)
• After merge to dev, sanity-check dev → main release flow still picks up release-please-action correctly on the next release PR

[sourcery-ai]

Sorry @w7-mgfcode, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c8c79800-f929-4981-93ae-5351a5fcb735

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci-sha-pin-third-party-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​numpy@​2.4.1
	pypi/​pandas@​3.0.0
	pypi/​mypy@​1.19.1
	pypi/​pydantic-ai@​1.51.0
	pypi/​pytest@​9.0.2
	pypi/​joblib@​1.5.3
	pypi/​scikit-learn@​1.8.0
	pypi/​openai@​2.16.0
	pypi/​pyright@​1.1.408
	pypi/​sqlalchemy@​2.0.46
	pypi/​uvicorn@​0.40.0
	pypi/​tiktoken@​0.12.0
	pypi/​python-dotenv@​1.2.1
	pypi/​pydantic@​2.12.5
	pypi/​ruff@​0.14.14
	pypi/​pydantic-settings@​2.12.0
	pypi/​pytest-cov@​7.0.0
	pypi/​pyyaml@​6.0.3
	pypi/​pytest-asyncio@​1.3.0
	pypi/​structlog@​25.5.0
	pypi/​httpx@​0.28.1
	pypi/​pgvector@​0.4.2
	pypi/​pandas-stubs@​2.3.3.260113

View full report