ci: pin actions to commit SHAs and the publish npm CLI to an exact version

[StephenTangCook]

Summary

Every third-party GitHub Action is now referenced by full commit SHA, with the release version in a trailing comment so Dependabot keeps updating both, and the publish step runs npx -y npm@12.0.2 instead of npm@latest.

Why

The release job holds id-token: write, and two mutable refs executed inside it: googleapis/release-please-action@v5 and npx -y npm@latest. A re-pointed upstream tag or a compromised npm CLI release would run with the Trusted Publisher credential live and could publish as us, or alter the tarball before it reaches the registry. The other workflows were on major tags too (nine distinct refs in total), which is the same exposure with less at stake, so they are pinned in the same pass.

Test plan

• Every workflow and the composite action still parse as YAML, and every uses: outside ./.github/actions/setup is a 40-hex SHA
• Each SHA is the commit its major tag resolved to on 2026-09-03, taken from git ls-remote against the upstream repos and peeled through annotated tags, so no action version changes
• npm@12.0.2 is what npm@latest already resolved to for the 0.10.12 and 0.10.13 publishes on 2026-09-01, so the publish step's behavior is unchanged
• pnpm typecheck / pnpm lint / pnpm test not run: no source files change, and biome's files.includes does not cover .github/ or Markdown. CI on this PR exercises the pinned ci.yml and codeql.yml directly.
• The release-please.yml publish step only runs on a release from main, so the pinned npm version is first exercised by the next release.

Notes for reviewer

• pnpm/action-setup@v4 currently resolves to v4.3.0 upstream even though a v4.4.0 tag exists, so the pin is v4.3.0 to match what runs today. Dependabot's next github-actions pass should propose v4.4.0 as a minor bump.
• Dependabot understands sha # vX.Y.Z pins and updates both parts. It does not track the NPM_VERSION env in release-please.yml; the workflow comment says to bump it by hand.
• Two in-place notes in SECURITY-REVIEW.md record that Info-002 (action SHA pinning) is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TSGLfzCh5VJAikAXtEdoxt

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	block-kitchen	f59862f	Commit Preview URL Branch Preview URL	Sep 03 2026, 09:47 PM

[github-actions]

Cloudflare preview

✅ Deployed f59862f · Branch preview · Commit preview · Build logs

[StephenTangCook]

Audit (pnpm) is red on this head, and the failure is not this PR's.

The check fails on four high advisories against fast-uri@3.1.5 (GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp), reached through @tightknitai/slack-block-kit-validator > ajv > fast-uri. This PR does not touch package.json or pnpm-lock.yaml: pnpm audit --audit-level=high fails identically against the unchanged lockfile from main, and GitHub reports the same four alerts on the default branch. The advisories postdate the last green CI run on main (2026-09-01). A re-run would not change the outcome, so I have not requested one. Every other check on this head passes.

No open PR carries a fix yet. The fix is lockfile-only: the patched release is within ajv's declared range, so no pnpm.overrides entry is needed.

pnpm update --lockfile-only --depth Infinity fast-uri

produces this diff, which audits clean (No known vulnerabilities found):

-  fast-uri@3.1.5:
-    resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==}
+  fast-uri@3.1.7:
+    resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==}
 ...
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.5
+      fast-uri: 3.1.7
 ...
-  fast-uri@3.1.5: {}
+  fast-uri@3.1.7: {}

I have kept it out of this PR so the diff stays the pinning change. It can land on main on its own, which also unblocks #208, or be folded in here on request.

---

Generated by Claude Code