Update actions version with pinned hash value

[backwind1233]

Background of this PR

In light of recent incidents involving GitHub Actions ( https://www.stepsecurity.io/blog/reviewdog-github-actions-are-compromised, https://www.theregister.com/2025/03/17/supply_chain_attack_github/) the OGHO Team with the recommendation from oracle/macaron team would like to ask you to pin the actions/download-artifact @v4 action with immutable commit.

For example: uses: actions/download-artifact@95815c3 # v4.2.1

The reason is that versions of actions/download-artifact before 4.1.3 have a known vulnerability. While the repos use v4 which is supposed to pull the latest version of the GitHub Action, the issue is that the users have no control on the specific version of actions/download-artifact . To make sure the repos we identified definitely use a fixed version, they can pin the Action to the immutable commit SHA, e.g., uses: actions/download-artifact@95815c3 # v4.2.1

In general, it is advised that all the GitHub Actions are pinned to the commit SHA and avoid using tags because if the Action is compromised, we guarantee that we don't run the malicious code."

"You can read more about this here"

More about this PR

• actions/upload-artifact@v4 and actions/download-artifact@v4 typically work together.
• Since we have decided to use the commit hash approach instead of tags to modify actions/download-artifact@v4, it would be best to ensure both workflows are updated with the same pattern.

Test

Test passed for all build workflows.

[backwind1233]

@edburns Could you help review this PR

[rjeberhard]

I spoke to the Security Team and they are requesting that the action references be pinned to specific SHA commits:

To ensure you're using an immutable version of a GitHub Action, it's important to pin it to a specific commit SHA. If you reference an Action by tag, and the tag is later moved or the Action is compromised, your workflows may unknowingly execute altered or malicious code. Pinning to a SHA prevents this by ensuring that your workflow always uses the exact version you reviewed and approved.

It's also a good practice to include the version string in a comment, as shown in the example. This helps tools like Dependabot keep your dependencies up to date by updating both the version string and the associated commit SHA when a new version is released.

[rjeberhard]

Pin to specific SHA hash as described in the original description.

[backwind1233]

Pin to specific SHA hash as described in the original description.
@rjeberhard Thank you for your response. I have updated the PR.