ci: pin github actions to commit shas

[dev-jodee]

Summary

• Pinned 79 uses: refs across 16 files under .github/ (15 workflows + the setup-solana composite action) from mutable tags/branches to immutable 40-hex commit SHAs.
• Supply-chain rationale: a git tag or branch is a mutable pointer. Whoever controls an action's repo (or anyone who compromises it) can repoint @v4 or @stable at new code, and that code then runs inside our jobs with whatever secrets and GITHUB_TOKEN scopes the step has. A commit SHA cannot be moved, so a pinned ref is the only ref that means "exactly the code we reviewed".
• Highest-value pins are the credential-handling third-party actions, all now SHA-pinned: dopplerhq/secrets-fetch-action (3 uses), google-github-actions/auth (1), docker/login-action (2). These see registry tokens, Doppler service tokens, and GCP workload-identity credentials.
• dtolnay/rust-toolchain selects the Rust channel by branch name, so each channel is pinned to its own branch head and keeps the branch name as its comment: 6 uses of # stable, 3 of # master. These are deliberately different SHAs and must not be collapsed into one.
• Each pin keeps a trailing # <version> comment, matching the convention already used by the pre-existing pin in rust-publish.yml. It preserves readability at a glance and is the form dependabot reads to bump SHA-pinned actions.

Test Plan

• grep -rn "uses:" .github/ returns zero refs that are not a 40-hex SHA, excluding local ./ composite/reusable-workflow refs (intentionally untouched).
• git diff touches only the ref portion of uses: lines: 79 insertions, 79 deletions, no other lines changed.
• CI on this PR exercises the pinned refs directly.

Notes

• Untouched by design: local uses: ./... composite actions and reusable workflows, and the already-SHA-pinned rust-lang/crates-io-auth-action in rust-publish.yml.

[greptile-apps]

Greptile Summary

This PR hardens GitHub Actions supply-chain integrity by replacing mutable third-party action tags and branches with immutable commit SHAs while retaining readable version or channel comments.

• Pins 79 external action references across 15 workflows and one composite action.
• Preserves local action references and the previously pinned crates.io authentication action.
• Uses distinct commits for the stable and master branches of dtolnay/rust-toolchain.

Confidence Score: 5/5

The PR appears safe to merge because the changes consistently replace mutable external action references with immutable SHA pins without establishing any workflow regression.

The diff changes only external action references and trailing comments, preserves existing action inputs and version distinctions, and introduces no supported functional or security failure.

Important Files Changed

Filename	Overview
.github/actions/setup-solana/action.yml	Pins the Solana setup composite action’s actions/cache dependency to the commit identified as v4.3.0.
.github/workflows/build-rust.yml	Pins checkout, Rust toolchain, cache, setup-just, and artifact-upload actions without changing workflow inputs or behavior.
.github/workflows/deploy-devnet-paymaster.yml	Pins checkout and credential-sensitive Doppler and Google Cloud actions used by the devnet deployment.
.github/workflows/docker-publish.yml	Pins checkout, Docker publishing actions, and github-script while preserving release behavior and action parameters.
.github/workflows/fork-external-live-manual.yml	Pins actions used by the privileged manual fork-validation workflow without altering its approval or rerun logic.
.github/workflows/fuzz.yml	Pins the master-channel Rust toolchain action and supporting fuzzing actions while retaining the explicit nightly toolchain.
.github/workflows/rust-publish.yml	Pins checkout, the stable Rust toolchain action, and github-script in the crate publication workflow.
.github/workflows/security.yml	Pins all external actions used by Rust, pnpm, and Miri security checks without changing audit commands.
.github/workflows/typescript-publish.yml	Pins checkout, Node, pnpm, cache, and publication-related actions while preserving package release behavior.

_{Reviews (1): Last reviewed commit: "ci: pin github actions to commit shas" | Re-trigger Greptile}