fix: pin 24 unpinned action(s), extract 1 inline secret to env var

[dagecko]

Re-submission of #3235. Had a problem with my fork and had to delete it, which closed the original PR. Apologies for the noise.

Summary

This PR pins all GitHub Actions to immutable commit SHAs and extracts an inline secret from a run: block into an env: mapping.

• Pin 24 unpinned actions to full 40-character SHAs
• Extract 1 inline secret (NPM_TOKEN) from run block to env var

How to verify

Review the diff, each change is mechanical and preserves workflow behavior:

• SHA pinning: action@v3 becomes action@abc123 # v3, original version preserved as comment
• Secret extraction: ${{ secrets.* }} in run: moves to env: block, referenced as "${ENV_VAR}" in the script
• No workflow logic, triggers, or permissions are modified

I've been researching CI/CD supply chain attack vectors and submitting fixes to affected repos. Based on that research I built a scanner called Runner Guard and open sourced it here so you can scan yourself if you want to. I'll be posting more advisories over the next few weeks on Twitter if you want to stay in the loop.

If you have any questions, reach out. I'll be monitoring comms.

- Chris (dagecko)

---

Summary by cubic

Pins 24 GitHub Actions to immutable commit SHAs and moves an inline NPM_TOKEN to an env block to harden CI. No workflow logic, triggers, or permissions changed.

• Dependencies

  • Pinned all unpinned actions to full 40‑char SHAs, preserving the original tag in comments (e.g., # v3).
  • Key pins include docker/login-action, pnpm/action-setup, useblacksmith/setup-docker-builder, useblacksmith/build-push-action, tailscale/github-action, erlef/setup-beam, dorny/test-reporter, dtolnay/rust-toolchain, bots-house/ghcr-delete-image-action.

• Refactors

  • Extracted ${{ secrets.NPM_TOKEN }} from a run: step to env: NPM_TOKEN and referenced it as ${NPM_TOKEN} in the publish-js-sdk workflow.

^{Written for commit 86acca7. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 14 files

[mogery]

Thank you!