ci: pin GitHub Actions to full-length commit SHAs

[maxandersen]

Pin all action references to full-length commit SHAs for supply chain security.

This is required for enabling the org-level policy:
Require actions to be pinned to a full-length commit SHA

Original version tags are preserved as comments for readability.
Consider adding Dependabot for GitHub Actions to keep pins updated:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Summary by CodeRabbit

• Chores
  • Updated continuous integration workflow configurations to use pinned versions of external GitHub Actions for enhanced security and improved build reproducibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c3cc7085-458b-4acb-bbbc-80dc16b17826

📥 Commits

Reviewing files that changed from the base of the PR and between 188167a and d7fc801.

📒 Files selected for processing (3)

• .github/workflows/main-build.yml
• .github/workflows/publish-packages.yml
• .github/workflows/tag-and-release.yml

---

📝 Walkthrough

Walkthrough

This pull request pins GitHub Actions to specific commit SHAs across three workflow files to replace floating version tags. The actions/download-artifact action in the main build workflow and the jreleaser/release-action across publish and release workflows are updated to use immutable commit references instead of semantic tags.

Changes

GitHub Action Version Pinning

Layer / File(s)	Summary
Pin actions/download-artifact in main-build .github/workflows/main-build.yml	The jreleaser job updates both the shared JBang distribution and native image artifact download steps to reference actions/download-artifact by a pinned commit SHA instead of the floating @v4 tag.
Pin jreleaser/release-action across workflows .github/workflows/publish-packages.yml, .github/workflows/tag-and-release.yml	The jreleaser/release-action reference in the publish step, announce step, and Run JReleaser step is changed from the floating @v2 tag to a specific commit SHA (@97b5e2f0e845de2fe1dbbdf451ac6a21233fafff) across multiple workflows.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A rabbit pins down every action so tight,
No floating versions causing workflows to fight,
Each commit locked in, reproducible and true,
The builds march forward in predictable blue.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: pin GitHub Actions to full-length commit SHAs' directly and accurately summarizes the main change across all three workflow files, which pin GitHub Action references to commit SHAs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pin-actions-to-sha

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}