Pin setup-node, upload-artifact and download-artifact to commit SHAs

[aterga]

Summary

Executes #85: the three actions that still floated on their mutable v4 major tag in deploy-native.yml — all in the build job that produces the binary the ship job installs on the deploy host — are now pinned to full commit SHAs, with the readable version in a trailing comment per the file's existing convention. health.yml postdates the issue and floated actions/setup-node@v4 the same way, so it gets the same pin, making the convention hold repository-wide.

The pins are behavior-preserving: each SHA is the commit the floating v4 tag resolves to today, so the workflows run exactly the code they ran on their last tick — just no longer subject to tag movement.

Related issues

Closes #85.

Changes

• .github/workflows/deploy-native.yml — pin actions/setup-node → 49933ea5288caeca8642d1e84afbd3f7d6820020 (v4.4.0), actions/upload-artifact → ea165f8d65b6e75b540449e92b4886f43607fa02 (v4.6.2), actions/download-artifact → d3f86a106a0bac45b974a628896c90dbdf5c8093 (v4.3.0); rewrite the comment above the build job's first step, which named these three as unpinned.
• .github/workflows/health.yml — pin actions/setup-node to the same commit.

Checked in the same pass, per the issue: ci.yml and publish-crate.yml were already fully pinned; imcp2-local-release.yml is dist-generated and already pins its own SHAs (left to its generator); deploy.yml / deploy-release.yml use only the local reusable workflow. No floating third-party ref remains in .github/workflows/.

How the SHAs were resolved and confirmed, per the issue's ask: each was read from the upstream repository's tags with git ls-remote and cross-checked two ways — the floating v4 tag and the versioned release tag name the same commit, and all three tags are lightweight (no peeled ^{} entry), so each SHA is a commit id rather than an annotated-tag object (a tag-object SHA would fail at uses: resolution).

The issue's "alternatives" section notes Dependabot for github-actions as a complementary follow-up to keep pins current; deliberately not included here to keep this the minimal pinning change.

Testing

• Both edited files parse as YAML (python3 -c "yaml.safe_load(...)"); diff is exactly the four uses: lines plus the comment rewrite.
• Verified repository-wide that every remaining uses: is a 40-hex-char SHA or a local ./ workflow reference.
• cargo build --locked --all-targets — not applicable (no Rust change).
• cargo test --locked --all-targets — not applicable (no Rust change).
• npm test --prefix monitoring/mcp-status — not applicable (dashboard unchanged).

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change — the stale "still float on their major tag" comment is the doc, and it is updated.
• No secrets, credentials, or internal-only information are included — the SHAs are public upstream release commits.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TUbJLPK174H3NRkSouQizP

---

Generated by Claude Code

[Copilot]

Pull request overview

Pins remaining mutable GitHub Actions references to immutable commit SHAs for supply-chain hardening.

Changes:

• Pins setup-node, upload-artifact, and download-artifact.
• Updates the deployment workflow’s pinning comment.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/deploy-native.yml	Pins deployment actions to verified SHAs.
.github/workflows/health.yml	Pins setup-node to a verified SHA.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.