Pin GitHub Actions to commit SHAs instead of floating tags

[Marvell69]

Description
All workflows reference actions by floating major-version tags (actions/checkout@v4, chromaui/action@latest). chromaui/action@latest in particular is a supply-chain risk — it always pulls whatever the action publisher pushes as latest, with no review step on this repo's side. Pinning to SHAs is a standard hardening practice, especially given this repo signs transactions and handles wallet connections.

Requirements and context

• Replace every uses: owner/action@vX (and especially @latest) with a pinned commit SHA, keeping a version comment for readability
• Prioritize chromaui/action@latest first as the highest-risk instance
• Add a note in docs/ci-cd.md about the policy and how to update pinned SHAs when bumping action versions

Suggested execution

git checkout -b ci/pin-actions-to-sha

• Pin all uses: references across all 8 workflow files
• Document the update procedure

Example commit message
ci: pin GitHub Actions to commit SHAs for supply-chain hardening

[akinboyewaSamson]

Hello Maintainer, Please I would like to work on this issue

[Fathia-tech14]

@Fathia-tech14 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I would like to take on this issue. I would appreciate being assigned to it. Thank you!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Fathia-tech14 to this issue.

[Anadudev]

@Anadudev has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hey team, I’d love to take on this issue. Pinning GitHub Actions to full commit SHAs is a straightforward change that makes a huge difference for supply chain security and build reliability by eliminating risks from upstream tag mutations.

I have good experience working with GitHub Actions and CI/CD pipelines, so I’m comfortable auditing all .github/workflows in the repo. I'll make sure to replace all floating tags with exact commit SHAs while keeping comment annotations (like # v4.1.0) so the workflows stay readable and easy to maintain.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Anadudev to this issue.

[edwarddavid929-png]

@edwarddavid929-png has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

i would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @edwarddavid929-png to this issue.

[drips-wave]

Congratulations, @edwarddavid929-png! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @edwarddavid929-png: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@edwarddavid929-png's PR #511 was approved and merged by @Marvell69.

🏆 @edwarddavid929-png: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (306 total points). Track your full progress on GrantFox.

👏 Great work, @edwarddavid929-png! Keep contributing to Invoice-Liquidity-Network.