update release to target all consumers, not just hash consumers

[derekmisler]

Related Issues

Closes: https://github.com/docker/gordon/issues/386

Summary

Fixes a critical bug where the release workflow pinned self-refs to a SHA that lacked compiled dist/ output, which would break setup-credentials resolution for every consumer. Also broadens ref matching so consumers pinned by any format (not just SHA # v…) are correctly updated, and expands the pinning scope to cover all workflow files.

Key changes

Release workflow (.github/workflows/release.yml)

• Two-pass release commit — Pass 1 stages dist/ and creates TEMP_SHA; Pass 2 pins all self-refs to TEMP_SHA and creates RELEASE_SHA parented on it. Consumers resolving sub-actions now land on a commit where dist/ exists.
• Wider sed patterns — @.* replaces the old @[a-f0-9]{40} # v… regex, catching any ref format (tag, branch, bare SHA).
• Expanded grep scope — scans review-pr/, .github/workflows/, .github/actions/ instead of 3 hardcoded files.
• Validation — dist/ existence check before staging; stricter post-pin verification (exact @SHA # version match, comment-line exclusion).

Expression injection hardening (action.yml, review-pr/action.yml, review-pr/reply/action.yml, review-pr.yml)

• GitHub context expressions moved from inline run: scripts to env: blocks.

Dependency pinning (package.json, pnpm-lock.yaml)

• All deps pinned to exact versions (no ^). Notable: @actions/core → 3.0.0, vitest → 4.0.18, typescript → 5.9.3.

Test fixes — Mocks updated for vitest 4.x ESM compatibility; rollup config suppresses harmless CJS/ESM interop warnings.

---

Tip

Comment /review to trigger the PR Reviewer agent for automated feedback.
Comment /describe to generate a PR description.

[derekmisler]

/describe