ci: pin actions to commit SHAs and the publish npm CLI to an exact version

[StephenTangCook]

Summary

The release workflow ran npx -y npm@latest publish with id-token: write in scope, so whatever latest pointed to at publish time executed with the OIDC publish credential live. Every third-party action was also referenced by a mutable major tag that upstream can re-point without any change in this repo, including googleapis/release-please-action, which runs in that same credential-bearing workflow. This PR pins both so the publish pipeline only ever runs code that was explicitly chosen here.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing behavior to change)
• Schema update (changes to src/slack-block-kit.schema.json)
• Docs / chore (no runtime change)

Changes

• SHA-pin all eight third-party actions to the full commit their major tag resolves to today, with the release version in a trailing # vX.Y.Z comment. The existing Dependabot github-actions config understands this format and will keep bumping the SHA and the comment together.

  Action	Was	Pinned to
  actions/checkout	@v7	3d3c42e5… (v7.0.1)
  actions/setup-node	@v4	49933ea5… (v4.4.0)
  pnpm/action-setup	@v4	b906affc… (v4.3.0)
  codecov/codecov-action	@v7	fb8b3582… (v7.0.0)
  oven-sh/setup-bun	@v2	0c5077e5… (v2.2.0)
  denoland/setup-deno	@v2	22d081ff… (v2.0.5)
  dependabot/fetch-metadata	@v3	25dd0e34… (v3.1.0)
  googleapis/release-please-action	@v5	45996ed1… (v5.0.0)

• Pin the publish CLI to npm@12.0.2. This is the version the last three releases (0.1.14 through 0.1.16) actually published with, per the _npmVersion the registry recorded for each, so pipeline behaviour is unchanged. The runner's Node 22.23.2 satisfies its ^22.22.2 engine range. The version lives in one shell variable so a future bump is a single edit.

• Workflow comment explaining why the CLI is pinned and that Dependabot does not track npx npm@… references, so it has to be bumped by hand and kept at or above 11.5.1 (the Trusted Publisher minimum).

Two things reviewers may want to double-check:

• denoland/setup-deno@v2 was a branch, not a tag. It is pinned to the branch head, which is the v2.0.5 release commit.
• pnpm/action-setup@v4 resolves to v4.3.0, not v4.4.0: upstream never moved the floating v4 tag. Pinning to what v4 actually resolves to keeps behaviour identical; Dependabot can propose the bump separately.

Testing

• pnpm test passes
• pnpm typecheck passes
• pnpm lint passes
• pnpm validate-schema passes (if the schema changed)
• Added or updated tests under test/ covering the change

Not run locally: no TypeScript changed. CI on this PR runs every pinned action except release-please-action (checkout, setup-node, pnpm, bun, deno, codecov), which is the real test for the pins. All workflow files parse as YAML and the publish script passes bash -n. release-please-action and the publish step only run on main, so the first release after merge is the end-to-end check for those two.

Schema changes

N/A

Checklist

• Commit messages follow Conventional Commits (required for release-please). ci: does not trigger a release.
• Public API changes are reflected in README.md (N/A, no API change)
• No secrets, tokens, or sample tenant data committed

🤖 Generated with Claude Code

https://claude.ai/code/session_01RGojvqCf6LBDRR7rms31CR

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}